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Islamic  State-inspired  terrorism  returned  to  the  headlines  this  month 
on  both  sides  of  the  Atlantic.  In  Orlando  the  United  States  suffered  its 
deadliest  terrorist  attack  since  9/11  while  in  France  a  police  couple  were 
stabbed  to  death  in  their  own  home  by  a  French  extremist  who  threat¬ 
ened  that  France  would  become  a  “cemetery”  during  the  Euro  2016  soccer  championships.  In  our 
cover  story  Richard  Walton  argues  the  threat  to  Euro  2016,  which  concludes  on  July  10,  is  more 
acute  than  for  any  other  international  sporting  event  in  history  because  of  the  unprecedented 
threat  to  France  from  the  Islamic  State  and  its  followers.  Walton  was  the  head  of  the  Metropolitan 
Police’s  Counterterrorism  Command  during  the  London  Olympics  and  looks  at  lessons  learned  for 
protecting  Euro  2016  and  the  upcoming  Rio  Olympics.  In  our  second  cover  story  Pieter  Van  Os¬ 
taeyen  outlines  how  the  emergence  of  three  clusters  of  radical  extremists  in  Brussels  and  Antwerp 
is  the  key  reason  Belgium  has  contributed  more  foreign  fighters  to  Syria  and  Iraq,  per  capita,  than 
any  other  Western  nation. 

Sam  Mullins  analyzes  all  47  cases  of  jihadist-inspired  violence  between  2012  and  the  June  12 
Orlando  attack.  He  finds  that  knife  attacks  like  the  one  in  France  this  week  were  the  most  com¬ 
mon  while  shootings  like  the  one  in  Orlando  were  the  deadliest.  Robert  Graham,  a  cyber  security 
specialist,  examines  how  terrorist  groups  are  exploiting  powerful  end-to-end  encryption  to  try  to 
communicate  securely.  He  explains  that  while  “end-to-end”  encryption  technology  cannot  be  put 
‘back  in  the  box,’  intelligence  agencies  still  have  several  strategies  available  to  intercept  the  “ends” 
of  communications.  The  June  issue  also  focuses  on  counterterrorism  challenges  facing  Greece. 
Our  interview  is  with  Vassilios  Kikilias,  who  served  as  Greece’s  Minister  of  Public  Order  and  Citi¬ 
zen  Protection  in  2014  during  which  time  he  oversaw  the  country’s  intelligence  and  police  services. 
Ioannis  Mantzikos  outlines  how  the  country  has  become  a  gateway  for  foreign  fighters  traveling 
back  and  forth  from  Syria  creating  potential  terrorist  threats  inside  Greece  as  well  as  the  rest  of 
Europe. 

Paul  Cruickshank,  Editor  in  Chief 
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Protecting  Euro  2016  and  the  Rio  Olympics: 

Lessons  Learned  from  London  2012 

By  Richard  Walton 


The  upcoming  summer  of  sport  brings  unprecedented 
and  unique  security  challenges.  In  the  wake  of  Islamic 
State  attacks  in  Paris  and  Brussels,  the  terrorist  threat 
to  the  UEFA  Euro  2016  football  (soccer)  tournament  is 
more  acute  than  for  any  international  sporting  event  in 
history.  Although  the  threat  from  Islamist  terrorism  is 
much  less  acute  for  the  Rio  Olympics  and  Paralympics, 
any  Olympic  Games  is  a  potential  terrorist  target, 
especially  in  an  age  of  increasingly  globalized  terror. 

The  British  experience  developing  and  implementing  a 
security  plan  to  protect  the  2012  London  Olympics  and 
Paralympics  provides  useful  lessons  for  protecting  large, 
international  sporting  events  from  terrorist  attacks. 


The  UEFA  Euro  2016  football  tournament,  which  kicks 
off  June  10  at  the  Stade  de  France  in  Paris,  is  one  of  the 
biggest  sporting  events  in  the  world.  Over  the  course 
of  a  month,  24  European  countries  will  play  51  match¬ 
es  at  10  venues  around  France  with  150  million  televi¬ 
sion  viewers  expected  to  tune  in  to  each  live  match.1  In  the  wake  of 
the  Islamic  State’s  terrorist  attack  on  France’s  capital  and  national 
stadium  last  November  and  its  continued  capability  and  intent  to 
strike  France,  the  terrorist  threat  to  the  tournament  is  more  acute 
than  for  any  other  international  sporting  event  in  history.11  While 
the  threat  from  Islamist  terrorism  to  the  Rio  Olympics,  which  be¬ 
gins  August  5,  is  nowhere  near  as  acute,  Brazilian  authorities  will 
need  to  remain  vigilant  about  a  range  of  security  threats  and  plan 
for  a  wide  range  of  scenarios. 

This  article  draws  on  my  experience  developing  and  imple¬ 
menting  a  security  plan  to  protect  the  2012  London  Olympics  and 


a  On  May  31,  the  U.S.  State  Department  issued  a  travel  alert  warning 
Americans  that  Euro  2016  “stadiums,  fan  zones,  and  unaffiliated 
entertainment  venues  broadcasting  the  tournaments  in  France  and  across 
Europe  represent  potential  targets  for  terrorists."  U.S.  State  Department 
Travel  Alert,  May  31,  2016. 


RichardWaltonheaded  the  Counter  Terrorism  Command  (S015) 
at  the  London  Metropolitan  Police  between  2011  and  2016.  He 
was  Head  of  Counter  Terrorism for  London  during  the  Queen’s 
Diamond  Jubilee  and  London  Olympic  and  Paralympic  Games 
in  2012,  the  United  Kingdom’s  largest  peacetime  policing  chal¬ 
lenge.  He  is  currently  the  director  of  Counter  Terrorism  Global  Ltd, 
a  senior  associate  fellow  at  the  Royal  United  Services  Institute 
(RUSI),  and  a  counterterrorism  consultant  for  CBS  News. 


Paralympics,  the  United  Kingdom’s  largest-ever  policing  operation, 
in  order  to  outline  the  security  challenges  facing  France  and  Brazil 
this  summer  and  to  offer  lessons  learned. 

Global  sporting  events  provide  a  perfect  target  for  terrorist 
groups  and  the  ultimate  opportunity  for  a  stunning  and  symbolic 
terrorist  attack.  The  Olympic  Games,  with  its  mass  appeal  and  glob¬ 
al  audience,  is  particularly  attractive  as  an  opportunity  for  political 
statements,  to  include  extreme  violence  such  as  terrorism.2  With 
billions  watching  and  the  world’s  media  assembled,  modern  tech¬ 
nology  enables  terrifying  images  to  be  broadcast  across  the  world 
in  seconds.  Grand  spectacles  such  as  these  showcase  the  values 
that  al-Qa'ida,  the  Islamic  State,  and  other  terrorist  groups  reject: 
world  unity,  democracy,  religious  freedom,  equality,  and  capitalism. 
Opening  ceremonies  are  a  particularly  attractive  target  for  a  terror¬ 
ist  group.  At  least  one-third  of  the  flags  carried  at  the  Rio  Olympics, 
for  example,  will  represent  countries  that  have  contributed  to  the 
U.S.-led  military  coalition  against  the  Islamic  State. 

Sporting  events  of  all  kinds  have  long  been  targeted  by  terrorist 
groups.  During  the  1972  Olympics  in  Munich,  a  Palestinian  ter¬ 
rorist  group  took  members  of  the  Israeli  national  team  hostage, 
eventually  killing  11  athletes  and  coaches  as  well  as  a  police  officer.3 
In  the  decades  that  followed,  sporting  events  were  repeatedly  in 
the  cross-hairs  of  terrorist  groups.  Between  1972  and  2004  there 
were  168  terrorist  attacks  linked  to  sports.4  The  Atlanta  Olympic 
Games  in  1996  were  disrupted  by  a  bomb  detonated  at  a  music 
concert  at  Centennial  Olympic  Park  in  an  attack  that  was  instigated 
by  a  former  U.S.  Army  soldier.5  Olympic  representatives  were  again 
targeted  in  2006  when  gunmen  stormed  an  Olympic  committee 
meeting  in  Baghdad  and  kidnapped  30  individuals.6 

Football  and  cricket  events  have  also  been  targeted.  Hours  before 
Real  Madrid’s  2002  Champions  League  semifinal  match  against  its 
rival  Barcelona,  a  car  bomb  left  by  the  Batasuna  Basque  separatist 
group6  exploded  close  to  Bernabeu  Stadium  in  Spain’s  capital,  in¬ 
juring  17  people.7  Pakistan  has  had  two  significant  terrorist  attacks 
linked  to  cricket.  The  first  occurred  in  2002  when  14  people,  in¬ 
cluding  11  French  naval  engineers,  were  killed  in  a  suicide  bombing 
outside  the  Karachi  hotel  where  the  New  Zealand  cricket  team  was 
staying.  The  second  took  place  in  2009  when  the  Sri  Lankan  cricket 
team’s  bus  was  attacked  by  the  terrorist  group  Lashkar-e-Jhangvi 
en  route  to  a  match  against  Pakistan.8 

The  Threat  to  Euro  2016 

The  Euro  2016  tournament  comes  at  a  difficult  time  for  France,  still 
recovering  from  a  series  of  deadly  attacks  across  the  country  that, 
in  the  past  two  years,  have  killed  147  people  and  seriously  injured 
hundreds  more.  France  continues  to  support  the  coalition’s  air  cam- 


b  Batasuna  was  banned  as  a  political  party  in  August  2002.  Its  terrorist  wing 
is  known  as  ETA. 


JUNE  2016 


WALTON 


2 


CTC  SENTINEL 


paign  over  Syria  and  Iraq,  and  its  president,  Francois  Hollande,  has 
declared  on  more  than  one  occasion  that  his  country  is  at  war  with 
the  Islamic  State. 

France  was  singled  out  in  a  fatwa  delivered  in  September  2014 
by  Abu  Mohammad  al-Adnani,  the  Islamic  States  official  spokes¬ 
person  and  the  man  responsible  for  its  international  terrorist  oper¬ 
ations  in  Europe.9  French  intelligence  agencies  found  it  impossible 
to  prevent  the  attacks  that  followed.  Their  challenges  were  exacer¬ 
bated  by  porous  borders  across  the  European  free  travel  area  (the 
Schengen  Area)  where  terrorists  and  weapons  moved  across  coun¬ 
tries  unhindered  by  border  checks. 

In  the  lead-up  to  Euro  2016  the  head  of  the  French  domestic 
intelligence  agency,  Direction  Generale  de  la  Securite  Interieure 
(DGSI),  Patrick  Calvar,  described  the  threat  to  France  in  stark 
terms:  “Clearly,  France  is  the  most  threatened  country  ...  we  know 
that  Daesh  [the  Islamic  State]  is  planning  new  attacks.”  He  add¬ 
ed  that  whereas  “the  attacks  of  last  November  were  carried  out  by 
suicide  bombers  and  Kalashnikov-wielding  gunmen  to  maximize 
the  number  of  victims,  we  risk  being  confronted  by  a  new  form  of 
attack:  a  terrorist  campaign  characterized  by  the  placing  of  explo¬ 
sive  devices  in  places  where  there  are  large  crowds  and  repeating 
this  type  of  action  to  create  a  climate  of  panic.”10  Last  month  France 
extended  its  state  of  emergency  from  the  November  Paris  attacks 
through  Euro  2016.  This  national  posture  gives  authorities  a  range 
of  powers,  including  the  ability  to  place  individuals  who  are  deemed 
a  security  threat  under  house  arrest.11 

Not  only  does  France  remain  in  the  cross-hairs  of  the  Islamic 
State,  but  the  group  has  already  shown  a  high  level  of  intent  and 
capability  to  target  international  football  matches  in  the  country, 
as  was  illustrated  on  November  13,  2015,  when  three  Islamic  State 


suicide  bombers  blew  themselves  up  outside  the  Stade  de  France 
during  an  international  friendly  between  France  and  Germany. 
Only  one  person  was  killed  outside  the  stadium,  but  seven  were 
seriously  injured.  Many  more  could  have  been  killed  if  the  attacks 
had  been  timed  for  when  the  75,000  fans  were  arriving  or  leaving 
the  venue  or  if  the  attackers  had  been  able  to  gain  entry  to  the  sta¬ 
dium.12 

With  the  eyes  of  hundreds  of  millions  of  television  viewers  fo¬ 
cused  on  France,  Euro  2016  is  an  even  more  attractive  target  for 
the  Islamic  State  because  the  group  has  been  particularly  keen  to 
garner  maximum  international  media  coverage  to  amplify  terror 
and  fear.  Then  there  is  the  revenge  factor,  which  may  make  Euro 
2016  an  irresistible  target;  several  countries  taking  part  in  the  tour¬ 
nament  have  been  targeting  the  so-called  caliphate  with  airstrikes, 
including  France,  Russia,  the  United  Kingdom,  and  Belgium. 

Investigators  were  not  therefore  surprised  when  Mohamed 
Abrini,  the  so-called  “man  in  the  hat”  at  Brussels  airport,  told  Bel¬ 
gian  interrogators  that  Euro  2016  was  the  target  of  the  Islamic  State 
cell  that  carried  out  the  Paris  and  Brussels  attacks.  These  claims 
are  still  being  assessed,  but  Belgian  authorities  believe  that  when 
key  members  of  the  cell  were  arrested,  the  remaining  terrorist  op¬ 
eratives  changed  their  plans  and  attacked  Brussels  airport  and  a 
metro  station.13 

It  is  important  to  note  that  the  Islamic  State  will  be  keenly  aware 
that  any  attack  anywhere  in  France  by  its  operatives  or  followers 
during  Euro  2016  will  get  global,  mass  media  coverage.  It  does  not 
have  to  attack  stadiums  to  achieve  this  windfall;  it  can  attack  fan 
zones  or  other  so-called  soft  targets  not  directly  associated  with 
football  and  still  be  seen  as  having  attacked  the  tournament.  It 
should  also  be  noted  that  because  of  its  recent  successful  attack  on 


Stade  de  France  in  Paris  following  the  November  2015  attacks  (AP) 
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Paris,  the  Islamic  State  has  been  able  to  sow  fear  ahead  of  the  tour¬ 
nament  simply  through  rhetoric  and  threats.  This  will  contribute 
to  inevitable  security  scares  during  Euro  2016. 

Al-Adnani  ratcheted  up  threats  in  an  audiotape  released  in  May 
calling  for  Islamic  State  fighters  and  followers  to  intensify  their  ef¬ 
forts  to  hit  the  West  during  the  month  of  Ramadan,  which  starts 
three  days  before  Euro  2016  and  coincides  almost  exactly  with  the 
tournament.1"1  Last  year  the  Islamic  State  had  told  its  followers  they 
would  receive  10  times  the  heavenly  rewards  for  carrying  out  at¬ 
tacks  during  the  Islamic  holy  month.15 

The  Paris  and  Brussels  attacks,  which  were  carried  out  by  a 
mostly  Franco-Belgian  Islamic  State  terrorist  cell,  clearly  demon¬ 
strated  the  group’s  capability  to  launch  an  attack  in  France  during 
Euro  2016.  As  many  as  9,000  Europeans  have  traveled  to  join  ji- 
hadist  groups  in  Syria  and  Iraq,  with  as  many  as  1,500  now  assessed 
to  have  returned  to  European  soil.16  According  to  the  DGSI,  over 
2,000  French  nationals  and  residents  are  on  the  radar  screen  of 
French  domestic  intelligence  for  their  links  to  jihadist  networks  in 
Syria  and  Iraq,  with  over  600  believed  to  be  currently  residing  in 
the  two  countries.1 

As  DGSI  chief  Calvar  recently  noted,  al-Qa'ida  and  its  affiliates 
in  Syria,  Yemen,  and  North  Africa  still  pose  a  danger  to  France.  It 
is  possible  that  al-Qa’ida’s  network  will  try  to  organize  an  attack 
during  Euro  2016  to  steal  the  Islamic  States  thunder.  A  significant 
number  of  French  recruits  have  joined  al-Qa'ida  affiliate  Jabhat  al 
Nusra  in  Syria.  Al-Qa  '  ida  in  the  Arabian  Peninsula  (AQAP)  trained 
at  least  one  of  the  brothers  who  attacked  Charlie  Hebdo  in  January 
2015,  and  al-Qa'ida  in  the  Islamic  Maghreb  (AQIM)  has  intensi¬ 
fied  its  attacks  on  Western  nationals  in  Africa.17 

The  Threat  to  Rio 

In  contrast  to  Euro  2016  and  despite  the  seemingly  obvious  oppor¬ 
tunities  that  the  Olympic  and  Paralympic  Games  in  Brazil  present 
to  terrorist  groups,  the  threat  in  Rio  or  elsewhere  in  the  country 
during  the  Games  will  most  likely  be  assessed  by  intelligence  agen¬ 
cies  as  low  to  medium,  which  is  unlikely  to  change  between  now 
and  the  start  of  the  event. 

Demography  and  geography  are  important  reasons  for  this.  Bra¬ 
zil  and  other  countries  in  South  America  do  not  face  anywhere  near 
as  great  a  challenge  from  violent  Islamist  extremism  as  France  and 
other  European  countries.  In  contrast  to  the  thousands  of  Euro¬ 
peans  who  have  traveled  to  join  the  Islamic  State,  only  a  handful 
of  Brazilians  have  made  the  trip.18  And  while  many  Islamic  State 
operatives  have  been  able  to  sneak  back  into  Europe  over  land  and 
sea,  Brazil  is  separated  from  the  theater  by  thousands  of  miles  of 
ocean.  That  said,  there  are  rising  concerns  that  the  numbers  of  Is¬ 
lamist  extremists  are  growing  in  Latin  America.  Earlier  this  month, 
Admiral  Kurt  Tidd,  commander  of  U.S.  Southern  Command,  stated 
that  the  Islamic  State  had  attracted  between  100  and  150  recruits 
from  Latin  America,  a  small  number  of  whom  had  attempted  to 


c  According  to  the  DGSI,  at  least  400  of  those  currently  in  Syria  and  Iraq 
are  believed  to  be  male  and  old  enough  to  fight.  More  than  200  French 
residents  are  in  transit  from  France  to  Syria  and  Iraq  and  more  than  800 
have  an  intent  to  travel,  according  to  DGSI.  And  almost  250  are  back  in 
France,  according  to  the  agency.  Audition  de  M.  Patrick  Calvar,  directeur 
general  de  la  securite  interieure.  Commission  de  la  Defense  Nationale  et 
Des  Forces  Armees,  Assemblee  Nationale,  May  10,  2016;  Jean-Charles 
Brisard  tweet  on  official  DGSI  figures  from  May  10, 2016. 


return  home.19 

Unlike  France,  Brazil  itself  is  not  a  priority  target  for  the  Islamic 
State.  Brazilian  officials  have  generally  avoided  commenting  on  the 
coalition  against  the  Islamic  State.  One  exception  was  in  June  2015 
when  Defense  Minister  Jaques  Wagner  welcomed  military  cooper¬ 
ation  with  Iraq,  including  the  provision  of  logistical  support  and 
training  to  Iraqi  forces  fighting  the  Islamic  State.20 

One  of  the  terrorist  risks  that  Brazilian  officials  fear  most  is  that 
of  a  lone  actor  in  contact  with  terrorist  networks  in  Syria  and  incit¬ 
ed  through  encrypted  social  media  to  undertake  a  terrorist  attack 
during  the  Olympic  Games.  Brazil’s  counterterrorism  chief,  Luiz 
Alberto  Sallaberry,  stated  in  April  that  there  had  been  a  rise  in  the 
number  of  Brazilian  nationals  suspected  of  having  sympathy  for 
the  Islamic  State.  He  also  pointed  to  a  tweet  posted  last  November 
by  Maxine  Hauchard,  a  French  national  featured  in  Islamic  State 
execution  videos,  that  threatened,  “Brazil,  you  are  our  next  target.”21 
Covert  intelligence  coverage  is  unlikely  to  intercept  such  a  conspir¬ 
acy,  which  is  why  community  intelligence-gathering  is  so  critical. 
An  individual  such  as  this  is  more  likely  to  be  detected  by  an  alert 
social  worker,  teacher,  or  mental  health  care  professional.  Still,  the 
difficulties  in  launching  an  attack  during  the  Rio  Olympics  will  not 
stop  the  Islamic  State  from  using  its  propaganda  before  and  during 
the  Games  to  instill  fear. 

As  well  as  being  vigilant  to  the  threat  from  the  Islamic  State  and 
al-Qa'ida,  Brazilian  security  officials  will  need  to  be  alert  to  the 
terrorist  wing  of  Hezbollah,  which  has  a  track  record  of  launching 
attacks  on  Israeli  and  Jewish  interests  in  South  America,  including 
the  bombing  of  the  Israeli  embassy  in  Buenos  Aires  in  1992,  which 
killed  23,  and  the  bombing  of  the  Asociacion  Mutual  Israelita  Ar¬ 
gentina,  the  country’s  largest  Jewish  organization,  in  1994,  killing 
85.22 

Brazil  should  also  think  more  broadly  about  terrorist  threats 
from  a  number  of  leftist  militant  groups  operating  in  neighboring 
countries  in  South  America,  which  may  see  the  Rio  Olympics  as  a 
rare  opportunity  to  get  global  coverage  for  their  cause.  One  group  of 
concern  is  the  Paraguay  People’s  Army  (EPP),  a  Marxist  rebel  group 
responsible  for  a  rising  number  of  attacks  in  northern  Paraguay, 
including  hostage-taking  of  Westerners.23  Another  potential  threat 
might  be  breakaway  factions  of  the  Revolutionary  Armed  Forces 
of  Columbia  (FARC)  displeased  with  its  ongoing  peace  talks  with 
Colombia’s  government.6 

How  We  Secured  the  London  Games 

Four  years  ago,  as  the  London  Olympic  and  Paralympic  Games 
beckoned,  al-Qa'ida  was  the  most  prominent  terrorist  threat  to 
the  world.  The  U.S.  drone  attacks  had  significantly  degraded  its 
leadership  in  the  Federally  Administered  Tribal  Area  (FATA)  region 
of  northwest  Pakistan,  but  the  group  still  had  the  capability  and 
intent  to  respond  and  carry  out  complex  terrorist  attacks. 

The  Islamic  State  in  Iraq  (ISI),  the  forerunner  to  the  Islamic 
State,  was  becoming  more  assertive  and  ambitious,  but  it  was  not 
the  global  terrorist  organization  that  the  Islamic  State  is  today.  Syr¬ 
ia  was  on  the  brink  of  civil  war,  but  the  ‘Caliphate’  had  not  been 


d  FARC's  tight  control  over  its  rank-and-file  membership  has  resulted  in  little 
opposition  thus  far  to  the  group's  decision  to  pursue  peace  talks.  Steve 
Salisbury,  "Where  is  the  Columbian  Peace  Process  Pleaded,"  Peace  Insider, 
February  23,  2016. 
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claimed  or  declared.  ISI’s  focus  was  on  securing  land  and  fighting 
its  enemies  in  Iraq. 

The  London  Olympics  were  just  over  a  year  away  when  I  was 
appointed  the  head  of  Counter  Terrorism  Command  (SOl5)  at  the 
London  Metropolitan  Police,  and  I  had  no  higher  priority  than 
working  with  the  key  stakeholders  to  develop  a  security  plan  to 
protect  the  Games.  At  the  heart  of  our  effort  was  thinking  through 
every  conceivable  attack  scenario  and  implementing  security  plans 
to  prevent  or  respond  to  them. 

A  hundred  days  before  the  start  of  the  Games,  preparations  in¬ 
tensified  to  deal  with  the  many  and  varied  threats  and  risks  asso¬ 
ciated  with  major,  global  sporting  events.  It  was  a  nervous  time 
for  police,  intelligence  agency  professionals,  and  the  government. 
Successful  counterterrorism  is  ultimately  only  measured  by  the 
absence  of  a  terrorist  incident.  Our  security  efforts  extended  far 
beyond  the  Olympic  venues.  An  attack  anywhere  in  the  United 
Kingdom  during  the  course  of  the  Games  would  be  viewed  as  at¬ 
tack  on  the  Olympics. 

We  were  running  multiple  terrorist  investigations  in  the  United 
Kingdom  and  internationally,  mindful  that  any  one  of  them  could 
implicate  a  plot  to  attack  the  Games.  Investigations  focused  partic¬ 
ularly  on  home-grown,  British  extremists  who  were  expressing  clear 
intent  to  carry  out  terrorist  attacks  in  the  United  Kingdom  at  that 
time,  individuals  who  rejected  British  values  and  who  supported 
the  global  jihad  narrative. 

Research  by  police  and  intelligence  agency  analysts  showed  that 
approximately  40  percent  of  the  several  thousand  Islamist  extrem¬ 
ists  across  the  country  were  committing  low-level  criminality  with 
offenses  that  included  benefit  fraud,  disqualified  driving,  and  even 
drug  crimes.  This  presented  us  with  an  opportunity  to  suppress 
their  criminal,  extremist,  and  radicalizing  behavior  while  simul¬ 
taneously  taking  them  on  using  routine  police  tactics.  Armed  with 
this  information,  I  set  out  a  strategy  that  was  lawfully  audacious, 
pursuing  vigorously  those  extremists  who  were  breaking  the  law, 
no  matter  how  minor  their  offenses  were.  The  strategy  expanded 
our  toolkit  of  disruptive  options,  using  criminal  as  well  as  terrorist 
legislation  to  suppress  the  activities  of  extremists  who  wished  to  do 
us  particular  harm. 

We  commissioned  our  informants  to  be  observant  for  unusual 
signs  and  activities,  and  we  heightened  the  alert  stakes  across  all 
our  law  enforcement  agencies.  We  also  enlisted  the  help  of  our  ‘eyes 
and  ears,’  the  tens  of  thousands  of  patrolling  police  officers  across 
the  country  who  engage  with  communities  every  day. 

Ahead  of  the  Olympics  we  developed  a  tailored,  social  media 
monitoring  capability,  which  allowed  us  to  observe  extremists’  use 
of  social  media  platforms  to  promulgate  their  views.  Sophisticated 
software  gave  us  ‘sentiment  analysis’  across  communities  and  en¬ 
abled  us  to  respond  to  and  prevent  planned  public  disorder  by  radi¬ 
cal  and  extremist  groups.  This  proved  to  be  of  immense  value  in  the 
run  up  to  and  for  the  duration  of  the  Olympics,  particularly  during 
the  two  months  that  the  Olympic  torch  made  its  way  through  the 
United  Kingdom.  This  capability  was  developed  in  just  four  months 
at  a  cost  of  GBP2  million  but  continues  to  be,  in  the  years  since, 
highly  valuable  to  counterterrorism  efforts  in  the  United  Kingdom. 
It  is  an  example  of  how  the  Olympic  Games  can  provide  a  security 
as  well  as  a  sporting  legacy  for  a  country. 

During  the  days  and  weeks  before  the  opening  ceremony  of  the 
London  Olympics,  working  in  tandem  with  MI5,  we  responded  to 
the  intelligence  we  had  gathered  and  executed  a  high  number  of 


“Hie  Counter  Terrorism  Command 
planned,  tested,  and  exercised  every 
conceivable  threat  scenario:  air  and 
maritime  threats;  chemical,  biological, 
radiological,  and  nuclear  attacks; 
cyber  attacks;  organized  crime  efforts; 
demonstrations;  and  riots.” 


search  and  arrest  warrants,  mindful  to  inform  communities  of  what 
we  were  doing  and  why.  Public  confidence  in  our  counterterrorism 
activities  was  crucial.  The  last  thing  we  wanted  to  generate  was  pub¬ 
lic  protest  and  unrest.  But  we  judged  it  necessary  to  leave  no  stone 
unturned  in  our  efforts  to  disrupt  any  terrorist  planning. 

The  Counter  Terrorism  Command  planned,  tested,  and  exer¬ 
cised  every  conceivable  threat  scenario:  air  and  maritime  threats; 
chemical,  biological,  radiological,  and  nuclear  attacks;  cyber  attacks 
on  national  computer  systems;  organized  crime  efforts  (such  as 
ticket  fraud  and  ticket  touting);  demonstrations;  and  riots.  Creative 
thinkers  were  on  overdrive.  Each  threat  or  risk  required  a  detailed, 
planned  response,  which  often  required  months  rather  than  weeks 
of  planning  as  well  as  the  prepositioning  of  assets.  Hundreds  of 
contingency  plans  were  prepared.  For  example,  we  thought  about 
and  developed  response  protocols  to  hypothetical  scenarios  such  as 
terrorists  or  activists  entering  the  Olympic  stadium  on  a  microlight, 
a  drone  armed  with  explosives  flying  into  one  of  the  opened-roof 
venues,  and  an  unidentified  fast  boat  failing  to  stop  for  police  ma¬ 
rine  units  as  it  approached  Olympic  sites  from  the  Thames. 

Interagency  rivalries  were  extinguished.  The  command,  control, 
and  coordination  (C3)  mechanisms  that  needed  to  be  designed  and 
understood  by  multiple  civilian  and  military  agencies  as  well  as  gov¬ 
ernment  ministers  were  a  challenge  but  one  we  achieved. 

We  were  able  to  set  up  a  state-of-the  art,  integrated  com- 
mand-and-control  system,  which  linked  together  multiple  control 
rooms  across  London  and  the  United  Kingdom.  Footage  from  our 
pre-existing  extensive  network  of  CCTV  cameras  as  well  as  an  array 
of  cameras  positioned  at  key  sites  gave  us  significant  coverage,  as 
did  teams  of  overt  and  covert  officers  patrolling  the  Olympic  sites 
and  access  points. 

There  was  a  “Gold”  operational  command-and-control  center 
based  in  a  warehouse  in  Lambeth  and  staffed  by  representatives 
from  all  police  and  security  agencies.  Additionally,  a  strategic  con¬ 
trol  center  was  based  at  New  Scotland  Yard  to  manage  the  interface 
and  coordination  between  all  agencies.  These  control  rooms  were, 
in  turn,  linked  to  “Bronze”  control  centers  at  each  Olympic  site. 
We  also  had  Covert  Control  centers  managing  counterterrorism 
surveillance  teams  deployed  against  targets  and  a  separate  control 
room  managing  our  reactive  police  resources  that  were  on  stand¬ 
by  in  case  there  was  any  incident:  these  included  specialist  teams 
of  counterterrorism  officers  stationed  in  vehicles  around  London 
and  ready  to  respond  to  any  terrorist  attack.  Bomb  disposal  units 
were  strategically  positioned  at  key  locations.  The  military  and 
intelligence  agencies  also  had  their  own  control  rooms  linked  to 
ours  under  a  single  command-and-control  protocol.  Securing  the 
Games  was  the  United  Kingdom’s  largest-ever  peacetime  policing 
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challenge. 

To  coordinate  all  our  efforts  every  morning  during  the  Olym¬ 
pics,  ministers  chaired  a  daily  security  coordination  meeting  that 
was  similar  to  the  government’s  “Cobra”  meetings.6  Joining  up  all 
of  these  nodes  required  significant  investment  in  high-end  systems. 
Just  as  with  our  development  of  social  media  warning  systems,  it 
provided  an  Olympic  legacy  to  our  counterterrorism  capabilities, 
the  benefits  of  which  are  still  being  felt  today.  Ahead  of  the  Olym¬ 
pics  we  also  invested  heavily  in  relationship-building  with  our 
counterparts  around  the  world  as  there  is  no  more  global  event  than 
the  Olympics.  Some  of  the  relationships  we  strengthened  during 
the  Olympics  have  been  useful  in  improving  information-sharing 
in  confronting  the  global  threat  from  the  Islamic  State. 

Once  the  Olympic  Games  got  underway,  we  identified  a  signif¬ 
icant  number  of  suspicious  packages  and  hoax  bomb  threats,  but 
there  were  no  significant  security  scares.  Our  approach  during  both 
the  Olympics  and  Paralympics  was  to  take  no  chances.  We  deployed 
mobile  SOl5  investigations  teams  to  chase  down  every  possible  lead 
as  quickly  as  possible.  Mixed  reactive  teams  of  experienced  counter¬ 
terrorism  officers  provided  real-time  response  to  all  threats,  leads, 
and  intelligence.  Duringthe  Olympics,  investigators  reached  any  lo¬ 
cation  within  minutes  to  assess  and  extinguish  any  potential  threat. 

A  linchpin  of  our  security  plan  was  to  secure  and  lock  down 
the  venues  themselves.  As  with  all  other  aspects  of  our  security 
preparations,  decades  of  dealing  with  sophisticated  IRA  terrorism 
had  made  our  British  counterterrorism  models  for  major  sporting 
events  the  best  in  the  world.  Our  lockdown-security  approach  in¬ 
volved  sweeping  every  inch  of  venues  days  and  weeks  before  events 
began.  Once  secure,  access  to  venues  was  then  strictly  limited 
through  the  deployment  of  high-end  search  regimes  such  as  those 
used  at  airports,  including  search  arches  (walkthrough,  security 
metal  detectors).  The  Olympic  village  was  also  subject  to  a  fingertip 
search  before  the  Games  began  and  access  was  strictly  controlled 
thereafter  by  screening  all  entering  individuals  for  weapons  and 
explosives.  The  lockdown  strategy  was  supplemented  by  a  concert¬ 
ed  drive  to  root  out  any  prospective  pass-holder  for  any  venue  who 
may  pose  a  threat  to  the  event.  The  smuggling  of  a  laptop  bomb 
onboard  a  passenger  aircraft  in  Somalia  in  February  was  a  reminder 
that  it  is  vital  that  potential  insider  threats  are  identified  and  dealt 
with  early.24 

Lessons  Learned  from  London  2012 

In  preparing  for  any  major  sporting  event,  it  is  essential  that  securi¬ 
ty  professionals  take  an  ‘all  threats,  all  risks’  approach  to  planning. 
Failure  to  do  this  can  result  in  unforeseen  risks  derailing  events 
where  too  much  focus  is  restricted  to  known  threats.  Public  protest 
at  the  Athens  Olympics  in  2004  almost  jeopardized  the  opening 
ceremony,  and  the  Zika  virus  in  Brazil  is  far  more  likely  to  damage 
the  success  of  the  Games  this  summer  than  terrorism. 

Security  planning  should  explore  every  possible  risk  scenario 
and  design  mitigation  measures  to  prevent  negative  effects  and 
to  minimize  impact.  Testing  and  exercising  the  response  to  every 
foreseeable  risk  scenario  prevents  security  planners  from  becoming 


e  Cobra  or  “Cabinet  Office  briefing  room  A”  are  meetings  convened  to 
discuss  high-priority  issues  cutting  across  various  U.K.  government 
departments.  They  have  frequently  been  held  at  times  of  national 
emergency. 


myopic.  It  is  vital  too  that  planners  make  the  distinction  between 
threats  that  can  be  assessed  by  understanding  the  capability  and 
intent  of  the  threat  and  then  risks  that  are  defined  as  possibilities 
and  opportunities  that  can  be  measured  in  terms  of  mathematical 
probability. 

In  France,  Brazil,  and  other  countries  hosting  major  sporting 
events  in  the  future,  intelligence-sharing  between  intelligence  agen¬ 
cies  and  police  forces  within  a  country  is  critically  important.  Ter¬ 
rorism  is  both  a  threat  to  national  security  (the  remit  of  intelligence 
agencies)  and  a  crime  and  threat  to  public  safety  (the  remit  of  police 
forces).  Also  important  is  responding  quickly  to  intelligence  coming 
in  from  overseas  countries.  The  lesson  we  learned  from  London 
2012  was  to  trust  the  intelligence.  While  information-sharing  can 
be  enhanced  during  a  major  sporting  event,  there  are  no  quick  fixes 
to  the  issue  of  intelligence  silos.  In  the  United  Kingdom  in  response 
to  the  threat  from  the  IRA  and  then  al-Qa '  ida,  it  has  been  a  25-year 
project  to  integrate  the  work  of  our  police  and  intelligence  services 
to  tackle  terrorist  threats. 

It  would  also  be  a  mistake  to  treat  Euro  2016  or  the  Olympics 
as  purely  host-city  sporting  occasions.  The  vulnerable  underbelly 
of  these  events  is  outside  of  the  host  cities  in  venues  and  stadiums, 
transport  hubs,  and  other  crowded  places  where  police  are  not  fa¬ 
miliar  with  high  levels  of  security.  An  attack  anywhere  in  France 
during  Euro  2016  is  an  attack  on  the  event  itself.  Only  a  compre¬ 
hensive  national  safety  and  security  strategy  will  prevent  such  at¬ 
tacks  from  occurring  and  keep  the  national  security  infrastructure 
focused  on  threats  and  risks  across  the  state. 

Heading  into  Euro  2016  there  is  particular  concern  that  fan 
zones,  where  large  groups  of  fans  will  watch  the  football  matches 
on  Jumbotrons,  could  be  targeted.  One  of  these  fan  zones  under  the 
Eiffel  Tower  has  the  capacity  for  90,000  people.  About  seven  mil¬ 
lion  supporters  attended  fan  zones  in  the  host  cities  during  the  Euro 
2012  championships  in  Ukraine  and  Poland.  French  authorities  are 
planning  to  put  these  areas  under  video  surveillance,  conduct  ex¬ 
plosive  sweeps  each  day,  use  metal  detectors  and  pat  downs,  and 
prohibit  large  bags  inside.25 

At  any  big  sporting  event  there  will  inevitably  be  areas  in  which 
crowds  gather  that  cannot  be  completely  secured.  For  example,  get¬ 
ting  80,000  fans  into  a  football  stadium  will  always  involve  queues. 
But  there  are  several  strategies  that  can  be  employed  to  mitigate  the 
threat,  such  as  those  we  used  at  London  2012,  including  placing 
CCTV  cameras  at  all  access  points  to  stadiums,  flooding  zones  with 
covert  officers  and  overt  police,  deploying  specialist  search  dogs, 
and  placing  ANPR  (automatic  number  plate  recognition)  around 
all  access  roads. 

During  Euro  2016,  France  is  likely  to  continue  to  rely  on  a  heavy 
military  presence.  A  portion  of  the  10,000  soldiers  already  posi¬ 
tioned  at  sensitive  sites  will  be  redeployed  to  protect  the  Euro  2016 
tournament  alongside  77,000  police,  gendarmes,  and  riot-control 
officers  as  well  as  13,000  private  security  guards,  all  to  protect  the 
estimated  2.5  million  people  who  will  watch  the  51  scheduled  foot¬ 
ball  matches  in  person.26  France  has  also  declared  the  stadiums 
no-fly  zones  and  has  pre-positioned  anti-drone  technology.27  Bra¬ 
zil  is  planning  to  deploy  around  85,000  security  personnel  for  the 
Games,  including  the  police  organization  National  Force  for  Public 
Security,  double  the  number  used  in  London  in  2012.28 

But  delivering  safety  and  security  effectively  is  not  about  sheer 
volume  of  military,  police,  or  civilian  security  guards  presence.  We 
learned  from  the  2012  Olympics  that  it  is  better  to  invest  in  intel- 
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ligence-gathering  capabilities  and  command-and-control  systems 
than  relying  on  swamping  the  streets  with  uniformed  staff. 

The  lesson  from  the  London  Olympics  was  that  security  is  best 
achieved  by  gathering  good  intelligence,  then  analyzing  and  acting 
upon  it  quickly,  supplemented  by  both  a  visible  and  invisible  police 
presence  on  the  ground.  Intelligence  analysis  needs  to  be  support¬ 
ed  by  a  multitude  of  modern  surveillance  tools  linked  to  one  com- 
mand-and-control  system.  These  technologies  include  advanced 
CCTV,  ANPR  systems,  movement  analysis  of  known  suspects,  and 
bulk  data  searching  of  flight  and  other  manifests  alongside  addi¬ 
tional  covert  surveillance  methodologies. 

Major  event  security  is  most  effective  when  it  combines  highly 
technical  systems  with  covert  intelligence  capabilities  under  an  in¬ 
tegrated  command-and-control  framework.  This  approach  reduces 
the  need  for  too  visible  of  a  uniformed  presence  as  much  of  this 
provision  is  invisible  at  the  event  itself.  The  result  is  that  the  public 
are  actually  less  fearful  but  better  protected. 

Contrary  to  popular  belief,  armed  soldiers  and  armed  police  do 
not  prevent  terrorism  or  necessarily  reassure  the  public.  Our  largely 
unarmed  police  presence  at  the  London  Olympics  created  a  relaxed 
atmosphere,  and  much  of  our  armed  policing  response  capabili¬ 
ties  were  not  visible  to  those  participating  or  watching  the  games. 
While  Britain’s  armed  forces  were  on  standby  during  the  London 
Olympics,  aside  from  assisting  with  our  search  regimes,  we  always 
kept  them  in  reserve. 


Politicians  and  security  chiefs  should  be  mindful  of  the  fine  bal¬ 
ance  between  encouraging  vigilance  in  the  public  mindset  and  scar¬ 
ing  the  population,  which  plays  into  the  terrorists’  hand.  Against  a 
backdrop  of  a  severe  global  terrorist  threat,  leaders  in  France  and 
Brazil  will  need  to  be  robust  and  calm.  And  if  there  is  an  attack  they 
will  have  to  do  everything  possible  to  ensure  it  does  not  derail  the 
entire  tournament.  In  London  we  operated  under  the  maxim  that 
“the  Games  must  go  on.”  In  the  event  of  an  attack  our  plan  was  to 
create  a  more  visible  security  presence  to  reassure  the  public  and 
then  do  everything  possible  to  get  the  city  back  to  normal  as  quickly 
as  possible. 

Delivering  security  in  times  of  high  threat  has  never  been  more 
challenging,  but  I  remain  optimistic  that  both  Euro  2016  in  France 
and  the  Olympic  and  Paralympic  Games  in  Rio  will  be  great  sport¬ 
ing  occasions.  Moving  forward,  the  worry  may  be  that  because  of 
the  increasingly  global  nature  of  the  terrorist  threat,  only  rich  coun¬ 
tries  will  have  the  resources  to  hold  secure,  international  sporting 
events,  and  so  it  is  all  the  more  important  that  Brazil  succeeds. 

Pierre  de  Coubertin,  the  French  founder  of  the  International 
Olympic  Committee,  once  said  that  “holding  the  Olympic  Games 
means  evoking  history.”  France  and  Brazil  will  need  to  ensure  that 
the  history  made  this  summer  is  sporting  history  alone  and  not  any 
other  kind.  CTC 
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Belgian  Radical  Networks  and  the  Road  to 
the  Brussels  Attacks 

By  Pieter  Van  Ostaeyen 


As  the  Paris  and  Brussels  attacks  made  clear,  the  high 
number  of  Belgian  foreign  fighters  in  Syria  and  Iraq  has 
severe  national  security  implications  for  Belgium  and 
neighboring  European  countries.  The  emergence  of  three 
overlapping  radical  networks  in  Antwerp  and  Brussels 
and  their  early  recruitment  of  fighters  for  the  Syrian 
jihad  is  the  key  reason  why  Belgium  has  more  foreign 
fighters  per  capita  than  any  other  Western  nation. 


Belgium  is  at  the  epicenter  of  the  Islamic  State’s  efforts 
to  attack  Europe.  With  at  least  451  foreign  fighters 
who  have  traveled  or  attempted  to  travel  to  Syria  and 
Iraq,”  Belgium  has  the  highest  number  of  foreign 
fighters  per  capita1  of  all  Western  countries.  This  ar¬ 
ticle  looks  at  how  the  steady  flow  of  foreign  fighters  from  Belgium 
over  the  course  of  the  last  five  years  culminated  in  the  attacks  on 
Paris  on  November  13,  2015,  and  Brussels  on  March  22,  2016.  It 
draws  on  hundreds  of  pages  of  Belgian  court  documents  and  a  da¬ 
tabase  of  Belgian  foreign  fighters  maintained  by  the  author  to  focus 
on  three  overlapping  recruitment  networks  that  have  been  active  in 
sending  Belgian  residents  to  the  battlefields  of  Syria  and  Iraq:  the- 
Sharia4Belgium  network,  the  Resto  Tawhid  network  of  Jean-Louis 


a  The  term  “Belgian  foreign  fighters”  refers  to  Belgian  nationals  and  non- 
Belgian  residents  of  Belgium  who  have  traveled  to  or  tried  to  travel  to  join 
jihadist  groups  overseas.  The  official  estimate  includes  269  still  in  Syria 
or  Iraq  (or  elsewhere),  six  individuals  on  their  way  to  the  warzone,  117  who 
have  returned,  and  59  who  tried  to  leave  but  were  stopped.  See  Pieter 
Van  Ostaeyen,  “New  Official  Numbers  on  Belgian  fighters  in  Syria  and 
Iraq,"  pietervanostaeyen.wordpress.com,  February  22,  2016.  According  to 
a  database  of  Belgian  foreign  fighters  maintained  by  the  author  and  Guy 
Van  Vlierden,  the  high-end  estimate  for  the  number  of  Belgian  nationals 
and  residents  who  have  traveled  to  Syria  and  Iraq  is  626.  See  also  Jim 
Brunsden,  “Belgium:  Journeys  to  Jihad,”  Financial  Times,  June  3, 2016.  One 
of  the  reasons  the  official  count  is  likely  lower  is  that  it  is  based  on  those 
for  whom  there  was  enough  evidence  to  bring  criminal  charges.  See  Paul 
Cruickshank,  “View  from  the  CT  Foxhole:  An  Interview  with  Alain  Grignard,” 
CTC  Sentinel  8:8  (2015).  Another  reason  the  database  maintained  by 
the  author  should  be  considered  a  high-end  estimate  is  because  only 
fragmentary  information  is  available  for  some  of  the  foreign  fighters  such 
as  only  a  kunya,  meaning  some  individuals  may  be  counted  more  than 
once. 


Pieter  Van  Ostaeyen  is  an  historian  and  Arabist  focused  on  rad¬ 
ical  Islamist  groups  and  Belgian  foreign fighters  involved  in  the 
war  in  Syria  and  Iraq.  Follow  @p_vanostaeyen 

The  author  wishes  to  thank  Paul  Cruickshank  for  his  considerable 
editorial  input. 


Denis,  and  the  so-called  Zerkani  network. 

The  reason  Belgium  has  seen  the  largest  per  capita  flow  of  for¬ 
eign  fighters  to  Syria  and  Iraq  is  not  because  radicalization  is  higher 
in  Belgium  than  other  northern  European  countries.  There  are  no 
metrics  to  suggest  Belgian  exceptionalism  in  this  regard.  And  it 
cannot  simply  be  explained  by  failures  of  Belgian  authorities,  po¬ 
lice,  and  security  services  to  prevent  travel.  Instead,  arguably  the 
key  reason  behind  the  elevated  travel  flows  from  Belgium  is  that 
clusters  of  likeminded  militants  emerged  in  Antwerp  and  Brussels 
and  were  drawn  into  the  orbit  of  radical  preachers  who  encouraged 
and  facilitated  their  travel  to  fight  jihad  early  on  in  the  Syrian  civil 
war.  This  laid  the  groundwork  for  increasing  numbers  to  join  them 
on  the  frontlines.b  As  several  Belgian  counterterrorism  officials  have 
pointed  out,  Belgian  foreign  fighters  got  a  “head  start.”0 

These  early  travel  flows  were,  in  turn,  partly  explained  by  the 
fact  that  Belgium  has  a  sizeable  population  of  North  African  Arab 
Muslims,  which  allowed  the  uprising  against  the  Assad  regime  to 
resonate  strongly  on  the  streets  of  Brussels,  and  made  travel  to  the 
conflict  easier  than  for  residents  of  a  city  with  a  high  concentration 
of  south  Asian  immigrants,  for  example,  Birmingham  in  the  United 
Kingdom. 

Historical  Roots 

Belgium  has  been  grappling  with  the  nexus  of  foreign  fighter  re¬ 
cruitment  and  terrorism  for  more  than  a  generation.  In  the  1990s 
Belgium  was  a  transit  country  for  recruits  of  Islamist  terrorist 
groups  like  GIA  and  the  GICM.2  The  al-Qa '  ida  hit  team  that  assas¬ 
sinated  Ahmad  Shah  Massoud,  the  head  of  the  Northern  Alliance, 
two  days  before  9/11  were  residents  of  the  Brussels  district  of  Mo- 
lenbeek.3  Malika  el-Aroud,  the  Belgian-Moroccan  widow  of  one  of 
the  suicide  bombers,  was  sentenced  in  May  2010  together  with  her 


b  It  could  be  argued  that  the  British  foreign  fighter  phenomenon  linked  to  al- 
Qa 'ida  in  Pakistan  in  the  1990s  and  2000s  was  similarly  linked  to  clusters 
of  extremists  associated  with  radical  figures  in  the  United  Kingdom  such  as 
Abu  Hamza  al  Masri,  Omar  Bakri  Mohammed,  and  Abu  Qatada.  See  Peter 
Bergen  and  Paul  Cruickshank,  “Clerical  Error:  The  Dangers  of  Tolerance," 
New  Republic,  August  8,  2005.  American  academic  Marc  Sageman  has 
written  about  how  informal  radical  groups  or  “bunches  of  guys”  formed  in 
such  places  as  the  fringes  of  the  al-Quds  mosque  in  Hamburg,  the  M-30 
mosque  in  Madrid,  the  Islamic  Cultural  Center  in  Milan,  and  Finsbury  Park 
in  London,  and  contributed  a  significant  proportion  of  the  Westerners 
who  became  involved  in  Islamist  terrorism  in  the  years  leading  up  to  and 
following  9/11.  See  Marc  Sageman,  Understanding  Terrorist  Networks 
(Philadelphia,  Pennsylvania:  University  of  Pennsylvania  Press,  2004),  p.  114, 
and  Marc  Sageman,  Leaderless  Jihad:  Terror  Networks  in  the  Twenty-First 
Century,  University  of  Pennsylvania  Press  (Philadelphia,  Pennsylvania: 
University  of  Pennsylvania  Press,  2008),  p.  86. 

c  Belgian  counterterrorism  officials  have  cited  the  comparatively  early 
departure  of  Belgian  militants  to  fight  in  Syria  as  one  of  the  key  reasons  so 
many  have  traveled.  For  example,  see  Nic  Robertson  and  Paul  Cruickshank, 
“Belgium  on  edge  after  year  of  terror,”  CNN,  December  30, 2015. 
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new  husband,  Moez  Garsallaoui,  for  recruiting  young  Belgian  and 
French  extremists  to  join  al-Qa'ida.4d  Her  website,  Minbar  SOS, 
was  one  of  the  most  visited  forums  by  Francophone  jihadis  across 
the  Western  world.5  One  individual  that  el-Aroud  championed  was 
Muriel  Degauque,  a  Catholic  convert  from  Charleroi  who  became 
the  first-ever  Western,  female  suicide  bomber  in  Iraq  after  she  and 
her  husband,  Issam  Goris,  traveled  from  Belgium  to  Iraq.6  Another 
key  figure  in  Belgian  extremist  circles  in  the  1990s  and  2000s  was 
el-Aroud’s  mentor  Bassam  al-Ayachi,  a  French  cleric  of  Syrian  de¬ 
scent  whose  Centre  Islamique  Beige  in  Brussels  was  linked  to  sev¬ 
eral  terrorism  cases.  His  son  was  one  of  the  first  Belgians  to  die  in 
Syria,6  and  some  of  the  so-called  Zerkani  network  were  influenced 
by  his  teachings.7 

The  First  Wave:  Sharia4Belgium 

Many  of  the  Belgians  who  were  part  of  the  first  wave  to  travel  to 
fight  in  Syria  were  linked  to  Sharia4Belgium,  a  Flemish  extrem¬ 
ist  group  founded  by  Fouad  Belkacem,  an  Antwerp-based  radical 
with  a  track  record  of  petty  crime.8  His  group  was  modeled  on  Is- 
lam4UK,  led  by  radical  cleric  Anjem  Choudary  and  had  launched 
throughout  its  existence  a  series  of  publicity  stunts  to  attract  atten¬ 
tion  from  the  media  and  potential  supporters/ Though  Belkacem 
was  dismissed  out  of  hand  by  some,  in  March  2012  the  head  of 
Belgium’s  Surete  de  l’Etat  (domestic  intelligence),  Alain  Winants, 
warned  that  Belkacem  was  radicalizing  individuals  to  violence  and 
Belgian  security  services  needed  to  track  those  in  his  network.  At 
the  time,  Winants  estimated  there  were  about  1,000  jihadi  sympa¬ 
thizers  in  Belgium  of  which  100  were  hardcore  supporters  and  of 
which  about  a  dozen  had  traveled  to  fight  jihad  overseas.9  Although 
Sharia4Belgium  claimed  to  have  disbanded  in  October  2012  it  con¬ 
tinued  proselytizing  as  wave  after  wave  of  recruits  left  for  Syria. 

To  date,  75  of  the  Belgian  foreign  fighters  who  have  traveled  to 
Syria  and  Iraq  were  directly  linked  to  Sharia4Belgium,  while  six 
others  at  first  were  linked  to  Sharia4Belgium  but  later  ended  up  in 
the  network  of  Jean-Louis  Denis.10  The  arrival  of  Sharia4Belgium 
members  in  Syria  early  on  in  the  civil  war  had  a  snowball  effect 
on  recruitment.  As  members  arrived  they  encouraged  their  friends 
back  in  Belgium  via  social  media  to  join. 

The  first  Belgians  who  left  for  Syria  joined  a  variety  of  jihadist 
outfits,  often  small  and  independent  groups  that,  in  time,  affiliat¬ 
ed  with  the  Islamic  State.  One  of  the  most  attractive  groups  was 
Majlis  Shura  al-Mujahidin,  a  group  led  by  brothers  Firas  and  Amr 
al-Absi.  One  of  the  first  Belgian  fighters  to  join  the  group  was  for¬ 
mer  Sharia4Belgium  member  Houssien  Elouassaki  (also  known  as 
Abu  Fallujah),  who  subsequently  became  a  key  point  of  contact  for 


d  Before  he  was  killed  in  a  drone  strike  in  Pakistan's  tribal  areas,  Garsallaoui 
encouraged  Toulouse  terrorist  shooter  Mohammed  Merah  to  launch 
attacks  in  France.  Paul  Cruickshank,  “Taking  Tea  with  a  Terrorist,”  CNN, 
October  17  2012;  Eric  Pelletier,  “Moez  Garsallaoui,  'mentor'  presume  de 
Merah,  aurait  ete  tue,"  L'Express,  October  18,  2012. 

e  Bassam  al-Ayachi  joined  the  rebel  group  Suqur  al  Sham  in  Syria.  Joanie 
de  Rijke,  “DS  Weekblad  op  frontbezoek  bij  de  Molenbeekse  imam  die 
shariarechter  werd  in  Syrie,"  De  Standaard,  February  7,  2014. 

f  Examples  are  abundant.  A  lecture  by  Dutch  poet  Benno  Barnard  at  the 
University  of  Antwerp  was  disrupted.  Marie-Rose  Morel,  a  politician  of 
Vlaams-Belang,  was  damned  to  hell.  In  Molenbeek  and  Antwerp  there 
was  frequent  rioting  linked  to  the  group.  See  Pieter  Van  Ostaeyen,  “Van 
Kruistochten  tot  Kalifaat,"  Pelckmans,  2015,  pp.  114-117. 
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other  Belgians  joining  the  group.  Elouassaki  himself  had  no  jihad¬ 
ist  contacts  whatsoever  in  Syria  before  he  left  and  wandered  the 
Turkish-Syrian  border  for  days  before  hitchhiking  his  way  through 
to  the  country. 

Elouassaki  became  the  emir  of  a  brigade  of  foreign  fighters 
within  Majlis  Shura  al-Mujahidin,  which  grew  to  include  Belgian, 
Dutch,  and  French  fighters.  Contacting  a  Belgian  who  already  was 
accepted  as  a  mujahid  in  Syria  was  far  easier  than  trying  to  get  into 
groups  like  the  al-Qa'ida  affiliate  Jabhat  al-Nusra,  which  strictly 
vetted  recruits.  Most  of  the  brigade’s  members  later  joined  the  Is¬ 
lamic  State,  while  Elouassaki  and  a  few  other  Belgians  and  Dutch 
joined  Jabhat  al-Nusra.11  g 

Resto  du  Tawhid  -  The  Jean-Louis  Denis  Network 

The  growth  of  Sharia4Belgium  was  mirrored  by  the  rise  of  several 
smaller  networks.  One  of  these  was  Resto  du  Tawhid,  an  organi¬ 
zation  led  by  Belgian  convert  Jean-Louis  Denis  (also  known  as  Le 
Soumis),  41,  a  former  farm  laborer  turned  convert  turned  extremist 
rabble  rouser.  At  least  50  of  Belgium’s  foreign  fighters  have  some 
sort  of  connection  to  Jean-Louis  Denis,  according  to  a  database 
maintained  by  this  author.  Illustrating  the  overlap  between  Belgian 
radical  networks,  a  significant  number  of  these  also  had  connec¬ 
tions  to  Sharia4Belgium  (six  individuals)  and  the  so-called  Zerkani 
network  (11  individuals).12  h  Resto  du  Tawhid  was  active  around  the 
Gare  du  Nord  Brussels  railway  station,  distributing  food  aid  to 
needy  Muslims.  However,  by  April  2013  it  was  clear  that  Resto  du 
Tawhid  was  not  just  about  charity.  When  two  16-year-old  boys  from 
Fernand  Blum  High  School  in  Schaerbeek  left  for  jihad  in  Syria, 
Jean-Louis  Denis  was  arrested  and  questioned  for  recruiting  them. 
He  said  defiantly  that  the  men  were  following  their  religious  duty.13 

While  Sharia4Belgium  focused  its  recruitment  efforts  in  An¬ 
twerp  and  the  Flemish  areas  between  Antwerp  and  Brussels,  in¬ 
cluding  Vilvoorde,  they  also  had  recruits  in  the  capital,  including 
in  Molenbeek,  a  majority  Francophone  district  in  Brussels  with  a 
large  population  of  North  African  immigrants.  Denis  mainly  oper¬ 
ated  in  the  Gare  du  Nord  area  but  steadily  became  more  involved 
in  Sharia4Belgium,  at  one  point  becoming  the  leader  of  its  Brussels 
branch.14  The  trial  of  Denis  and  his  recruits  made  clear  that  there 
was  not  mere  spillover  between  these  groups.  Not  only  did  Denis 


g  A  significant  amount  of  the  detail  on  Elouassaki  comes  from  messages  the 
author  exchanged  with  Dutch  and  Belgium  Jabhat  al-Nusra  members  via 
direct  messaging  on  Twitter  during  the  months  of  September,  October,  and 
November  2015.  Contacts  included,  among  others,  Levantenaar,  Abu  Saeed 
al -FHallabi/al-FHollandi,  Polderjihadi,  and  Abu  Jandal  at-Tawzani. 

h  Jean-Louis  Denis  received  a  10-year  prison  sentence  for  his  recruitment 
activities  in  a  trial  that  concluded  in  January  2016.  Nine  others  who 
traveled  were  given  prison  sentences  as  well.  For  more  on  the  case,  see  Jim 
Brunsden,  “Belgium:  Journeys  to  Jihad,”  Financial  Times,  June  3,  2016. 
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Belgian  police  and  soldiers  stand  in front  of  blown-out  windows  at  Brussels  airport  following  the  March  22,  2016,  attacks.  (AP) 


connect  Sharia4Belgium  and  Resto  du  Tawhid,  he  also  provided  a 
key  connection  between  Sharia4Belgium  operating  mainly  in  Flan¬ 
ders  and  the  so-called  Zerkani  network  based  in  and  around  the 
Molenbeek  district  of  Brussels.15 

The  Zerkani  Network 

By  far  the  most  dangerous  network  to  have  surfaced  in  Belgium 
was  a  group  of  Brussels-based  radicals  centered  around  Khalid 
Zerkani,  a  42-year-old,  Moroccan-born  resident  of  Brussels  who 
targeted  youngsters  in  and  around  Molenbeek.  Nicknamed  Papa 
Noel  (Santa  Claus)  because  of  his  cash  handouts,  Zerkani  led  his 
network  of  criminals  as  a  gang.  If  Zerkani  was  the  father  figure  of 
the  group,  then  Fatima  Aberkan,  55,  a  close  associate  of  Malika  el- 
Aroud,  who  Belgian  officials  labeled  a  “passionara  of  jihad,”  was  its 
mother  figure,  inciting  her  children  and  their  circle  to  fight  jihad 
in  Syria  and  raise  funds.161  While  Zerkani  played  a  leading  role  in 


i  Aberkan’s  brother  Abdelhouaid  was  an  associate  of  el-Aroud's  husband, 
Abdessater  Dahmane,  who  killed  Massoud  and  was  convicted  for  helping 
get  him  to  Afghanistan.  Another  man  tried  in  relation  to  the  Massoud 
assassination  was  Abderrahmane  Ameuroud  who  was  shot  in  the  leg  and 
arrested  at  a  train  stop  in  Brussels  in  March  because  he  was  suspected 
of  involvement  in  a  terror  plot  being  organized  by  Zerkani  acolyte  Reda 
Kriket.  Guy  Van  Vlierden,  "The  Zerkani  Network:  Belgium’s  Most  Dangerous 
Jihadist  Group,”  Jamestown  Foundation,  April  12, 2016. 

j  She  was  the  actual  mother  of  three  of  the  Belgian  foreign  fighters  tried 
in  the  Zerkani  trial:  Abdelmouneim  Lachiri,  Yassine  Lachiri,  and  Soufiane 
Alilou.  During  the  time  she  spent  in  Syria  she  sent  messages  to  her  circle 
in  Belgium  encouraging  them  to  travel  to  Syria  to  fight  jihad.  See  verdict  in 
first  Zerkani  trial,  “Jugement,  Tribunal  de  premiere  instance  Francophone 
de  Bruxelles,"  July  29,  2015,  pp.  144-155. 


proselytizing,  a  review  of  hundreds  of  pages  of  court  documents  by 
the  author  reveals  that  the  young  men  in  these  social  networks  also 
encouraged  each  other  to  travel  to  Syria.k 

Zerkani’s  recruits  were  constantly  on  the  move  in  Brussels,  rob¬ 
bing  tourists  and  passers-by.  Between  2012  and  2014  at  least  60 
Belgium-based  extremists  linked  to  the  Zerkani  network  traveled 
to  Syria  and  Iraq,17  with  Zerkani  facilitating  their  travel  and  pay¬ 
ing  some  of  them  up  to  €4,000  from  the  proceeds  of  his  gang’s 
thefts.  Investigators  established  that  he  provided  recruits  with  fake 
documentation  and  put  them  in  touch  with  individuals  who  could 
smuggle  them  across  the  Turkish-Syrian  border.18 

The  most  infamous  of  Zerkani’s  recruits  was  Abdelhamid 
Abaaoud,  the  coordinator  of  the  November  13  attacks  in  Paris.19 
Others  who  were  part  of  the  network  and  who  subsequently  be¬ 
came  involved  in  European  terror  plots  include  the  Belgian  Islam¬ 
ic  State  operative  Chakib  Akrouh,  who  blew  himself  up  during  a 
French  commando  raid  in  Saint  Denis  several  days  after  the  Paris 
attacks;  Najim  Laachraoui,  the  cell’s  bomb  maker;  and  Reda  Kriket, 
a  French  Islamic  State  recruit  who  was  arrested  in  Paris  with  explo¬ 
sives  and  weapons  several  days  after  the  Brussels  attacks.20 


k  For  example,  the  family  members  of  Zerkani  acolyte  Chakib  Akrouh  believe 
Zerkani's  right-hand  man  Gelel  Attar,  27,  was  the  one  who  persuaded 
Akrouh  to  travel  to  Syria.  Attar  housed  Zerkani  at  his  Molenbeek  residence, 
where  he  organized  meetings  encouraging  young  men  to  travel  to  wage 
jihad,  before  traveling  with  Akrouh  to  Syria  in  January  2013.  Akrouh  was 
part  of  the  10-man  Islamic  State  team  that  attacked  Paris  last  November. 
Fie  blew  himself  up  during  a  French  commando  raid  on  a  Saint  Denis 
terrorist  safe  house  several  days  after  the  attacks.  Verdict  in  first  Zerkani 
trial,  pp.  65-69. 
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Abaaoud  had  connections  to  many  of  the  Islamic  State-linked 
plots  and  attacks  against  Europe  over  the  past  two  years.  The 
French  Islamic  State  recruit  Mehdi  Nemmouche  spoke  on  the 
phone  with  Abaaoud  for  almost  half  an  hour  a  few  months  before  he 
attacked  the  Jewish  Museum  of  Belgium  in  Brussels  in  May  2014, 
while  Abaaoud  also  coordinated  the  terror  plot  that  was  thwarted 
in  Verviers  in  Belgium  in  mid-January  2015.21  He  is  also  suspected 
of  playing  a  role  in  a  plot  by  Sid  Ahmed  Ghlam  to  attack  a  Paris 
church  in  April  2014  and  of  links  to  Ayoub  el  Khazzani,  a  Moroccan 
extremist  who  tried  to  carry  out  an  attack  onboard  a  Thalys  train 
in  August  2015.22 

The  Zerkani  network  had  a  very  different  profile  from  Sharia- 
4Belgium.  Whereas  Fouad  Belkacem  openly  preached  in  the  streets 
and  Sharia4Belgium  even  had  a  YouTube  channel  and  website,  the 
group  around  Zerkani  operated  clandestinely.  Whereas  the  Zerkani 
network  operated  more  like  a  criminal  gang  and  drew  in  a  lot  of 
unemployed  people  from  the  Brussels  Canal  Zone  and  a  significant 
number  with  criminal  backgrounds  but  little  or  no  Islamic  back¬ 
ground,  Sharia4Belgium  had  recruits  from  Antwerp,  Vilvoorde, 
and  Brussels  of  various  backgrounds,  including  from  all  layers  of 
the  Muslim  population,  even  people  with  higher  education  who  had 
been  inspired  by  their  message. 

While  Sharia4Belgium  recruits  have  tended  to  be  very  amateur¬ 
ish,  Zerkani’s  recruits’  history  of  petty  criminality  and  gangsterism 
naturally  equipped  them  with  better  tradecraft  in  operating  clan¬ 
destinely,  helping  them  travel  to  and  from  Syria  with  ease.  Those 
subsequently  plotting  attacks  were  able  to  draw  on  contacts  from 
criminal  milieus  to  source  weapons  as  well  as  the  chemicals  needed 
for  bomb-building  in  addition  to  cars  and  safe  houses. 

Despite  these  differences  in  the  networks,  Belgian  extremist  cir¬ 
cles  were  a  small  world.  For  example,  Paris  attack  bomb  maker  Na- 
jim  Laachraoui,  who  was  recruited  to  fight  in  Syria  by  the  Zerkani 
network,  attended  a  protest  at  the  Myanmar  Embassy  in  Brussels  in 
July  2012  in  the  company  of  Jean-Louis  Denis  and  Sharia4Belgium 
member  Houssien  Elouassaki.23 

Abaaoud  and  Laachraoui  both  left  Belgium  for  Syria  in  early 
2013  and  joined  the  ranks  of  Majlis  Shura  al-Mujahidin,  which  at 
that  point  was  led  solely  by  Amr  al-Absi  whose  Katibat  al-Muhaji- 
rin1  was  led  by  Sharia4Belgium  member  Elouassaki.24  When  al-Absi 
decided  to  join  the  Islamic  State,  both  Abaaoud  and  Laachraoui 
followed  his  lead.25 

The  Syrian  Terror  Factory 

It  appears  that  in  the  summer  of  2013  Abaaoud  joined  the  ranks 
of  Katibat  al-Battar  al-Libiyya,  a  Libyan  branch  of  the  Islamic 
State  that  was  founded  in  December  2012.26  Some  described  the 
group  as  an  elite  brigade  of  the  Islamic  State,  counting  upwards 
of  700  and  maybe  even  1,500  members.27  Most  of  the  members 
were,  as  the  group’s  name  suggests,  of  Libyan  descent,  some  of 
them  with  a  jihadist  pedigree  going  back  to  the  Iraqi  insurgency 
and  even  Afghanistan.  There  was,  however,  an  important  branch  of 
French-speaking  fighters  counting  a  significant  amount  of  Belgian, 
French,  and  Tunisian  fighters. 

In  Syria,  French  and  Belgian  fighters  had  a  strong  connection 


I  This  should  not  be  confused  with  Katibat  al-Muhajirin  wa’I-Ansar,  the  group 
led  by  Umar  as-Shishani,  who  later  became  a  high-ranking  official  in  the 
Islamic  State. 


Abdelhamid  Abaaoud  (right)  with  the  two  Islamic  State  operatives 
killed  during  a  Belgian  commando  raid  in  Verviers  (Dabiq) 


to  each  other  because  of  linguistic  and  national  links.  This  brought 
together  one-time  members  of  Sharia4Belgium,  Resto  du  Tawhid, 
and  the  Zerkani  network.  For  example,  Mohamed  Soulayman,  a 
Belgian  foreign  fighter  recruited  by  the  Zerkani  network,  used  the 
same  cell  phone  while  in  Syria  as  Houssien  Elouassaki,  the  Majlis 
Shura  al-Mujahidin  commander,  and  other  former  Sharia4Belgium 
members.28 

The  Belgian  contingent  in  Syria  maintained  contact  with  fight¬ 
ers  who  had  returned  to  Europe  as  well  as  their  social  circle  and 
families  back  home.  It  was  via  these  networks  that  new  fighters 
were  recruited  and  that  weapons,  ammunition,  money,  and  fake 
identity  papers  were  transferred  across  Europe.29  m  The  case  of  Sou- 
fiane  Alilou,30  the  son  of  Fatima  Aberkan,  the  so-called  “passionara 
of  jihad,”  demonstrated  just  how  easy  it  was  to  move  back  and  forth 
to  Syria.  Alilou  spent  a  month  in  Syria  between  October  19,  2012, 
and  November  16,  2012.  He  then  left  Belgium  a  second  time  with 
two  new  recruits  on  February  12,  2013,  and  came  back  to  Belgium 
with  one  of  them  on  February  25,  2013.  A  month  later  he  left  Bel¬ 
gium  again  but  was  stopped  at  the  Turkish  border  and  sent  back  to 
Belgium.  The  Belgian  police  ignored  him  on  arrival  in  Belgium,  and 
two  weeks  later  he  escorted  two  more  recruits  to  Syria,  escorting 
his  mother  back  to  Belgium  in  May  on  his  return  home.  Extraor¬ 
dinarily,  he  made  a  fourth  successful  trip  to  Syria  on  November  9, 
2013.  When  Alilou  returned  to  Belgium  on  July  25,  2014,  he  was 
finally  arrested.31 

In  the  summer  of  2014  a  Twitter  account  under  the  name  “the 
lover  of  martyrs,”  closely  affiliated  with  Katibat  al-Battar,  published 
a  list  of  killed  fighters  in  the  ranks  of  the  Libyan  branch.  Among  the 
purportedly  deceased  Belgian  fighters  with  links  to  the  Zerkani  net¬ 
work  was  Abu  ‘Umar  al-Belgiki,  a.k.a.  Abdelhamid  Abaaoud.32  By 
faking  his  own  death  Abaaoud  was  able  to  go  off  the  grid  for  several 
months,  giving  himself  the  opportunity  to  prepare  for  a  terror  plot 
in  Belgium  that  the  following  January  was  thwarted  by  a  Belgian 
commando  raid  in  Verviers.11 


m  Between  the  Paris  and  Brussels  attacks  these  networks  also  helped  hide 
surviving  members  of  the  Islamic  State  terror  cell,  for  example  Salah 
Abdeslam. 

n  After  the  raid  and  the  killing  of  Abaaoud's  accomplices,  the  same  Twitter 
account  published  pictures  of  both  deceased  men  on  January  26,  2015, 
linking  them  to  the  Libyan  Islamic  State  brigade. 
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It  is  possible  that  operatives  within  Katibat  al-Battar  encouraged 
Abaaoud  to  set  in  motion  a  campaign  of  terrorism  against  Europe. 
The  Paris  attacks  resembled  the  group’s  mass-casualty  Tnghimasi’0 
operations.33  As  Aymenn  Jawad  Al-Tamimi  has  noted,  the  group 
was  tasked  with  organizing  plots  that  “involved  foreign  fighters, 
sleeper  cells  in  Europe  that  were  connected  with  an  operative  in¬ 
side  of  Syria  and  Iraq,  usually  in  a  lower  to  midlevel  position.”34  It  is 
also  noteworthy  that  Paris  attacker  Bilal  Hadfi  was  in  contact  with 
several  members  of  Katibat  al-Battar  via  Facebook.35 

Target:  Europe 

Since  the  fall  of  2014  Zerkani’s  street  gangsters,  hardened  by  their 
experience  fighting  with  the  Islamic  State  in  Syria,  have  been  at  the 
heart  of  the  Islamic  State’s  campaign  of  terrorism  in  Europe.  This 
was  set  in  motion  after  senior  Islamic  State  operative  Abu  Muham¬ 
mad  al-Adnani,  the  Islamic  State’s  spokesman,  declared  war  on  the 
West  in  a  September  22,  2014,  audiotape.36 

The  first  time  Europe  was  confronted  with  a  clear  attempt  to 
follow  up  on  these  orders  came  on  January  15,  2015,  when  Belgian 
police  and  security  forces  raided  a  house  in  Verviers.  Phone  taps 
had  revealed  that  the  men  hiding  inside  were  probably  planning  an 
attack  in  France  or  Belgium.37  During  the  raid,  two  Belgian  foreign 
fighters,  later  named  as  Sofiane  Amghar  and  Khalid  Ben  Larbi,38 
were  killed  while  a  third  was  arrested.  The  plotters  had  all  been  in 
touch  with  Abaaoud  who  had  traveled  to  Athens  to  coordinate  the 
plot.39p 

The  November  13,  2015,  Paris  attacks  were  coordinated, 
planned,  and  launched  from  Belgium.  After  slipping  back  into  Eu¬ 
rope  cell  members  went  underground  in  three  safe  houses  in  Bel¬ 


o  Inghimasiyyun  are  highly  trained,  heavily  armed  fighters  carrying 

pistols,  light  machine  guns,  and  explosive  belts.  They  aim  to  kill  as  many 
adversaries  or  civilian  victims  before  they  themselves  are  killed  in  battle 
by  enemy  fire  or  by  running  out  of  bullets  and  self-detonating  themselves 
amidst  a  crowd  of  enemies/targets.  These  kind  of  attacks  have  been  used 
frequently  on  the  battleground  in  Syria  and  Iraq  and  resemble  the  attacks 
in  Tunisia  on  the  Bardo  Museum  in  Tunis  and  on  the  beach  in  Sousse. 

p  Besides  an  entire  arsenal  of  heavy  weapons,  including  Kalashnikovs  and 
hundreds  of  bullets,  there  were  also  Belgian  police  uniforms  found  in 
the  safe-house.  One  of  their  targets  was  reportedly  a  high-ranking  police 
officer,  with  the  intention  of  beheading  him  on  camera.  ‘‘Wat  we  weten  over 
de  antiterreuroperatie  in  Verviers,"  Het  Laatste  Nieuws,  January  16, 2015. 


gium,  including  a  bomb  factory  in  Brussels.  While  Abaaoud  led  the 
attack  team  that  carried  out  the  Paris  attacks  on  the  ground,  Belgian 
investigators  believe  the  overall  leader  of  the  cell  was  Mohammed 
Belkaid,  an  Algerian  Islamic  State  operative  who  had  previously 
resided  in  Sweden.40 

Belkaid  was  killed  on  March  15  as  he  provided  covering  fire  for 
several  cell  members,  including  Salah  Abdeslam,  a  childhood  friend 
of  Abaaoud,  to  escape  a  safe  house  in  the  Forest  neighborhood  of 
Brussels.41  When  Abdeslam  was  located  and  arrested  a  few  days  lat¬ 
er,  the  remaining  members  of  the  cell,  including  Najim  Laachraoui 
and  Khalid  and  Ibrahim  Bakraoui  (two  brothers  with  a  history  of 
armed  robberies)  fearing  arrest,  accelerated  an  attack  on  the  Brus¬ 
sels  airport  and  metro,  killing  32.42q 

Conclusion 

Three  overlapping  recruitment  networks  in  Belgium— Sharia- 
4Belgium,  Resto  du  Tawhid,  and  the  Zerkani  network — have  been 
responsible  for  the  recruitment  of  a  significant  number  of  foreign 
fighters  from  Belgium.  Court  proceedings  have  established  these 
networks  have  ties  to  at  the  very  least  174  Belgian  foreign  fighters 
who  traveled  to  Syria  and  Iraq.1 

These  numbers  illustrate  the  recruitment  power  of  charismatic 
preachers  and  the  significant  problems  created  by  clusters  of  radi¬ 
calized,  likeminded  individuals.  As  American  academic  Marc  Sage- 
man  has  argued,  in-group  radicalization  within  social  networks  has 
been  key  to  radicalization  to  violence.43  To  prevent  future  Brussels 
and  Paris  attackers,  Western  governments  should  focus  on  prevent¬ 
ing  the  growth  of  similar  radical  networks  in  the  rest  of  Europe. 
Belgium  and  its  European  neighbors  will  be  living  with  their  legacy 
for  some  time  to  come. 


q  The  so-called  ‘man  in  the  hat’  at  Brussels  airport,  Mohamed  Abrini,  a 
longtime  Molenbeek  resident,  told  Belgian  investigators  that  Euro  2016 
was  the  ultimate  target  of  the  cell,  a  claim  that  is  still  being  assessed.  See 
Paul  Cruickshank  and  Mariano  Castillo,  “Paris,  Brussels  attackers  sought  to 
target  Euro  2016,”  CNN,  April  11,  2016. 

r  These  were  the  cases  in  which  biographical  information  indicated  a  link. 

As  this  information  is  fragmentary  on  a  significant  number  of  those  in  the 
database,  the  number  of  Belgian  foreign  fighters  with  links  to  the  three 
networks  is  likely  to  be  significantly  higher.  This  database  is  maintained  by 
the  author  and  Guy  Van  Vlierden. 


Citations 


1  Guy  Van  Vlierden,  “Foreign  Fighters  in  Syria  and  Iraq  -  An  Updated  Per 

Capita  Count,"  Emmejihad,  April  26,  2016.  4 

2  Jean-Pierre  Borloo,  “Condamne  vendredi  a  Bruxelles,  le  Frangais  allie  au 
GIA  avait  deja  pris  sept  ans  a  Paris  Neuf  ans  de  prison  pour  le  terroriste 
Melouk,"  Le  Soir,  May  19, 1999.  See  also  Paul  Cruickshank,  "View  from  the 

CT  Foxhole:  An  Interview  with  Alain  Grignard,”  CTC  Sentinel  8:8  (2015).  5 

3  Jean-Pierre  Stroobants,  “Molenbeek,  la  plaque  tournante  beige  du 


terrorisme  islamiste,"  Le  Monde,  November  16,  2015. 

Nic  Robertson  and  Paul  Cruickshank,  “Belgian  court  convicts  three  of 
recruiting  to  fight  in  Afghanistan,"  CNN,  May  10, 2010.  See  also  Paul 
Cruickshank,  “The  2008  Belgium  Cell  and  FATA's  terrorist  pipeline,"  CTC 
Sentinel  2:4  (2009). 

Paul  Cruickshank,  “Love  in  the  Time  of  Terror,”  Marie  Claire,  February 
2009. 


12 


JUNE  2016 


VAN  OSTAEYEN 


CTC  SENTINEL 


6  Nicholas  Watt,  “From  Belgian  cul-de-sac  to  suicide  bomber  in  Iraq,’’ 
Guardian,  December  2, 2005;  Paul  Cruickshank,  “Italy  arrests  linked  to 
Brussels  ‘al  Qaeda’  recruiting  network,"  CNN,  May  15,  2009. 

7  See,  for  example,  verdict  in  first  Zerkani  trial,  “Jugement,  Tribunal  de 
premiere  instance  Francophone  de  Bruxelles,”  July  29, 2015,  p.  74. 

8  Andrew  Fiiggins,  “Flead  of  Belgian  Group  Said  to  Recruit  Fighters  for  Syria 
Gets  12-Year  Term,”  New  York  Times,  February  11,  2015. 

9  See  interview  with  Alain  Winants,  “Sharia4Belgium  moet  worden  ver- 
boden,”  De  Standaard,  March  26,  2012. 

10  Database  of  Belgian  foreign  fighters  maintained  by  the  author  and  Guy 
Van  Vlierden. 

11  Simon  Demeulemeester,  “Vlaamse  Syriestrijders  begaan  oorlogsmis- 
daden,"  Knack,  June  8, 2013;  verdict  in  second  Zerkani  trial,  “Jugement, 
Tribunal  de  premiere  instance  Francophone  de  Bruxelles,"  May  3,  2016,  p. 
28;  Ben  Taub,  "Journey  to  Jihad,”  New  Yorker,  May  26,  2015. 

12  Database  of  Belgian  foreign  fighters  maintained  by  the  author  and  Guy 
Van  Vlierden. 

13  “II  distribue  des  repas  et  recrute  pour  la  Syrie,”  La  Libre  Belgique,  April  23, 
2013. 

14  Verdict  in  first  Zerkani  trial,  pp.  44,  66. 

15  Ibid.,  pp.  63, 85,  86. 

16  Guy  Van  Vlierden,  “Van  9/11  tot  Parijs:  Fatima's  familie  zit  ertussen,”  Het 
Laatste  Nieuws,  March  1,  2016;  Guy  Van  Vlierden,  “Paris  Attack  Ringleader 
Abdelhamid  Abaaoud,"  CTC  Sentinel  8:11  (2015). 

17  Database  is  maintained  by  the  author  and  Guy  Van  Vlierden. 

18  Verdict  in  first  Zerkani  trial,  pp.  44-65. 

19  For  a  detailed  profile  of  Abdelhamid  Abaaoud,  see  Van  Vlierden,  “Paris 
Attack  Ringleader  Abdelhamid  Abaaoud." 

20  Erin  McLaughlin,  Lisa  De  Bode,  and  Margot  Fladdad,  “Jihad  recruiter  free, 
teen’s  mom  furious,"  CNN,  May  13,  2016. 

21  Paul  Cruickshank,  “The  inside  story  of  the  Paris  and  Brussels  attacks," 
CNN,  March  30,  2016. 

22  Rukmini  Callimachi,  “How  ISIS  Built  the  Machinery  of  Terror  Under  Eu¬ 
rope’s  Gaze,"  New  York  Times,  March  29,  2016;  Cruickshank,  “The  inside 
story  of  the  Paris  and  Brussels  attacks." 

23  Verdict  in  second  Zerkani  trial,  p.  128. 

24  Ibid.,  p.  127;  Taub,  “Journey  To  Jihad." 


25  Ben  Taub,  “Abdelhamid  Abaaoud’s  Death  in  Paris,”  New  Yorker,  November 
19,  2015. 

26  Van  Vlierden,  “Paris  Attack  Ringleader  Abdelhamid  Abaaoud.” 

27  Cameron  Colquhoun,  “Tip  of  the  Spear?  Meet  ISIS’  Special  Operations 
Unit,  Katibat  al-Battar,"  Bellingcat,  February  16,  2016. 

28  Verdict  in  second  Zerkani  trial,  p.  81. 

29  “Parcours  d’une  filiere  Franco-Beige," TTU  Online,  November  19,  2015. 

30  See  verdict  in  first  Zerkani  trial,  pp.  105-115. 

31  Ibid;  “Van  9/11  tot  Parijs:  Fatima’s  familie  zit  ertussen,”  Het  Laatste  Nieu¬ 
ws,  March  1,  2016. 

32  Pieter  Van  Ostaeyen,  “Katibat  al-Battar  and  the  Belgian  fighters  in  Syria," 
pietervanostaeyen.wordpress.com,  January  21,  2015. 

33  Colquhoun. 

34  Andrew  Higgins  and  Kimiko  De  Freytas  Tamura,  “An  ISIS  Militant  from 
Belgium  Whose  Own  Family  Wanted  Him  Dead,”  New  York  Times,  Novem¬ 
ber  18,  2015. 

35  Ibid. 

36  Abu  Muhammad  al-’Adnani,  “Indeed  Your  Lord  Is  Ever  Watchful,” 
pietervanostaeyen.wordpress.com,  September  25,  2014. 

37  Van  Vlierden,  “Paris  Attack  Ringleader  Abdelhamid  Abaaoud.” 

38  Ibid. 

39  Cruickshank,  "The  Inside  Story  of  the  Brussels  and  Paris  attacks;”  Pieter 
Van  Ostaeyen,  “The  Islamic  State:  An  Archive  of  Dabiq  Magazine,  Issue  7," 
pietervanostaeyen.wordpress.com,  April  24,  2015. 

40  Cruickshank,  “The  inside  story  of  the  Brussels  and  Paris  attacks." 

41  "Brussels  raid  over  Paris  attacks:  Dead  gunman  was  Algerian  national," 
BBC  News,  March  16,  2016;  Angelique  Chrisafis,  “Paris  attacks  suspect 
Salah  Abdeslam  arrested  in  Brussels  terror  raid,"  Guardian,  March  18, 
2016. 

42  Benjamin  Siegel  and  Alexander  Mallin,  “Terror  Arrest  In  Belgium  Likely 
Accelerated  Timetable  for  Brussels  Bombings,  US  Lawmakers  Say,”  ABC 
News,  March  22, 2016. 

43  Marc  Sageman,  Understanding  Terrorist  Networks  (Philadelphia,  Penn¬ 
sylvania:  University  of  Pennsylvania  Press,  2004);  Marc  Sageman,  Lead¬ 
erless  Jihad:  Terror  Networks  In  the  Twenty-First  Century,  University  of 
Pennsylvania  Press  (Philadelphia,  Pennsylvania:  University  of  Pennsylva¬ 
nia  Press,  2008). 


JUNE  2016 


CTC  SENTINEL 


13 


A  View  from  the  CT  Foxhole:  Vassilios 
Kildlias,  Greece’s  Former  Minister  of  Public 
Order  and  Citizen  Protection 

By  Paul  Cruickshank  and  Charles  Kim 


Vassilios  Kikilias,  a  member  of  the  Greek  parliament,  served  as 
Greece’s  Minister  of  Public  Order  and  Citizen  Protection  between 
June  2014  and  January  2015  during  which  time  he  oversaw 
Greece’s  police  and  intelligence  agencies.  He  is  currently  the 
Special  Coordinator  of  Immigration  Policy for  the  New  Democ¬ 
racy  political  party  and  a  member  of  the  parliament’s  Standing 
Committee  on  Public  Administration,  Public  Order  and  Justice. 
Kikilias  also  works  as  an  orthopedic  surgeon  in  Athens  and  was  a 
member  of  the  Greek  national  basketball  team  between  1990  and 
2004. 

CTC:  You  assumed  the  position  of  Minister  of  Public  Order  and 
Citizen  Protection  on  June  10,  2014.  A  few  days  later,  the  Is¬ 
lamic  State  declared  a  caliphate  in  Syria  and  Iraq.  How  did  that 
change  things  for  you? 

Kikilias:  It  was  clear  that  Greece,  because  of  its  geography,  had 
become  a  transit  country  for  foreign  fighters  traveling  to  Syria  and 
that  fighters  would  try  to  travel  back  in  the  opposite  direction. 
Greece  has  16,500  miles  of  maritime  borders  and  8,000  islands, 
which  is  not  easy  to  guard.  Sol  realized  we  needed  to  work  with  our 
European  colleagues  because  Greek  borders  are  European  borders. 
From  the  start  I  stressed  to  senior  Greek  police  and  intelligence 
officials  the  importance  of  exchanging  information  with  our  allies 
and  agencies  such  as  Europol  and  Interpol. 

The  other  challenge  was  trying  to  maintain  the  effectiveness  of 
Greek  police,  security,  and  intelligence  agencies  during  an  unprec¬ 
edented  economic  crisis.  We  have  55,000  individuals  working  in 
Greek  police  and  a  significant  number  working  in  our  intelligence 
services,  and  it  was  critical  to  inspire  them  to  do  their  job  because, 
quite  frankly,  I  did  not  have  the  financial  tools  to  adequately  pay 
them. 

Another  thing  I  tried  to  do  was  to  anticipate  rather  than  react  to 
threats.  One  example  of  this  was  following  a  trip  to  meet  with  senior 
U.S.  intelligence  officials  in  2014. 1  stated  at  the  European  security 
meeting  in  Milan  that  it  was  essential  for  us  to  have  access  to  pas¬ 
senger  name  record  (PNR)  data  for  our  flights  much  like  the  United 
States.  Unfortunately,  at  the  time,  many  European  nations  felt  that 
it  would  be  a  blow  to  civil  liberties.  It  was  only  after  the  attacks  in 
Paris  and  Brussels  that  the  European  Union  finally  adopted  PNR. 

CTC:  How  has  Greece  dealt  with  the  migrant  crisis? 

Kikilias:  During  the  six  months  that  I  oversaw  Greek  security  and 
police  agencies  until  there  was  a  change  in  government  with  the 
election  of  the  Syriza  party,  I  believe  our  government  took  the  ap¬ 
propriate  measures  to  limit  freedom  of  movement  of  the  irregular 
migrants  streaming  into  Greece,  while  adhering  to  the  Geneva  Con¬ 
vention  for  Refugees.  We  made  a  distinction  between  refugees,  who 
were  processed  according  to  international  protocols,  and  illegal  im¬ 
migrants,  who  were  sent  to  detention  centers  and  returned  to  their 


country  of  origin.  When  the  left-wing  political  party  Syriza  came  to 
power  in  January  2015,  they  had  a  significantly  different  approach 
toward  border  security,  national  security,  and  collaboration  with 
our  international  allies.  In  my  view  this  sent  a  message  to  illegal 
human-smuggling  operations  to  expand  their  business.  Between 
when  the  Syrian  conflict  began  in  2011  and  2014,  only  80,000  mi¬ 
grants  passed  through  Greece.  Since  then  more  than  a  million  have 
come  through  our  borders.  While  the  worsening  civil  war  in  Syria 
contributed  significantly  to  the  rise  in  the  number  trying  to  enter 
Europe,  in  my  view,  the  crisis  was  aggravated  by  the  initial  policies 
of  the  Syriza-led  government. 

CTC:  Do  you  believe  that  the  government  has  now  come  to 
terms  with  the  migrant  crisis? 

Kikilias:  Yes,  they  were  obliged  to  change  their  policies  under  Eu¬ 
ropean  pressure.  The  European  Union  understood  the  difficulty 
of  controlling  the  high  volume  of  refugees  moving  through  our 
borders,  and  in  response  they  worked  to  close  the  northern  corri¬ 
dor  that  runs  from  Thessaloniki  to  Skopje  in  FYROM  to  Rijeka  in 
Croatia.11  Together  with  the  E.U.-Turkey  agreement  on  migrants  in 
March  2016  and  NATO  ships  stepping  up  patrols  and  assisting  the 
Greek  and  Turkish  coast  guard  in  the  eastern  part  of  the  Aegean 
Sea,  it  has  significantly  ameliorated  the  situation.  With  the  north¬ 
ern  corridor  now  effectively  shut,  55,000  refugees  and  illegal  im¬ 
migrants  are  stuck  in  northern  Greece  and  the  Attica  area  around 
Athens.  This  has  created  its  own  set  of  problems,  but  it  has  sent  a 
message  that  it’s  pointless  to  pay  people  smugglers  to  cross  the  Ae¬ 
gean  Sea  as  you  will  not  be  able  to  reach  northern  Europe  through 
Greece. 

CTC:  What  is  the  concern  about  potential  radicalization  of 
irregular  migrants  who  are  currently  living  in  the  transient 
camps  in  Greece? 

Kikilias:  Despair  and  hopelessness  can  change  the  psychology  of 
a  person,  so  there  is,  of  course,  concern  about  radicalization.  The 
illegal  camp  that  has  emerged  in  Calais  is  a  case  in  point  because  it 
has  created  significant  issues  for  Frances  internal  security.  Similar 
camps  have  sprouted  up  in  Greece.  I  have  had  serious  concerns 
about  knowledge  gaps  that  have  emerged  in  recent  months  about 
the  people  in  these  camps,  including  the  illegal  camp  at  Idomeni 
in  northern  Greece,  which  swelled  to  over  10,000  people  before  it 


a  In  March  2016  several  European  countries  situated  along  a  corridor  that 
stretched  through  the  Balkans  and  had  been  used  by  irregular  migrants 
to  travel  to  northern  Europe  began  to  restrict  severely  the  admission  of 
irregular  migrants  trying  to  transit  northward. 
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was  shut  down  in  late  May.b  As  well  as  providing  necessary  food 
and  shelter,  mechanisms  need  to  be  in  place  for  Greek  police  and 
intelligence  services  to  screen  those  inside  the  camps. 

CTC:  As  has  been  well  documented,  several  of  the  Paris  attack¬ 
ers  posed  as  Syrian  refugees  when  they  entered  the  European 
Union  through  the  Greek  island  of  Leros.  Three  days  before  the 
Paris  attacks  in  November  2015,  there  was  an  unannounced  on¬ 
site  inspection  by  European  Union  officials  at  six  Greek  border 
sites.  Their  conclusion  was  there  were  “serious  deficiencies  in 
the  carrying  out  of  external  border  control  by  Greece,  in  partic¬ 
ular  due  to  the  lack  of  appropriate  identification  and  registra¬ 
tion  of  irregular  migrants  at  the  islands,  of  sufficient  staff,  and 
of  sufficient  equipment  for  verifying  identity  documents.”1  How 
can  things  be  improved? 

Kikilias:  I  was  not  in  office  then,  but  it  was  chaos  back  in  the  sum¬ 
mer  and  autumn  of  2015.  You  have  to  understand,  were  talking 
about  small  communities  of  10,000  to  20,000  residents  on  the 
Greek  islands  in  the  northern  Aegean  close  to  Turkey  to  which 
many  migrants  were  flocking.  Suddenly  it  was  D-Day,  and  they 
were  dealing  with  thousands  of  migrants  coming  in  per  day  on  plas¬ 
tic  boats  that  were  getting  ripped  apart,  resulting  in  people  drown¬ 
ing.  The  Greek  government  had  two  courses  of  action:  keep  all  the 
migrants  on  these  islands  with  no  food  or  shelter,  which  would  have 
been  an  absolute  disaster,  or  to  try  to  relocate  them.  But  because 
of  the  urgent  need  for  relocation  it  was  very  difficult  to  check  their 
documents. 

To  deal  with  these  issues,  we  need  modern  communication  sys¬ 
tems  to  be  able  to  screen  people  who  pass  through  Greek  islands 
and  land  borders.  We  need  to  be  able  to  put  that  information  into 
a  database  and  compare  it  with  the  intelligence  services  of  other 
countries.  We  need  to  deepen  our  cooperation  with  Western  in¬ 
telligence  agencies.  We  need  to  be  able  to  communicate  quickly  at 
moments  of  crisis.  We  need  to  be  able  to  identify  illegal  immigrants 
who  pose  a  security  risk.  We  need  proper  training  and  specialized 
personnel  from  the  European  Union  to  help  our  border  security 
agency,  Greek  police,  and  intelligence  services. 

We  need  E.U.  help  to  fund  the  necessary  modernizations.  Greece 
is  in  its  seventh  year  of  recession  and  in  a  very  difficult  financial  po¬ 
sition.  The  financial  crisis  and  migrant  crisis  were  a  perfect  storm. 
European  Union  countries  need  to  share  the  burden  by  accepting 
the  relocation  of  refugees,  and  they  also  need  to  develop  a  unified 
strategy  to  deport  illegal  immigrants.  Europe  has  economic  agree¬ 
ments  with  developing  countries,  including  Nigeria  and  Cameroon, 
but  some  of  these  countries  will  not  re-accept  the  deported  illegal 
immigrants.  While  there  are  some  bilateral  agreements,  including 
an  agreement  between  the  United  Kingdom  and  Pakistan  for  send¬ 
ing  illegal  Pakistani  immigrants  back  home,  this  needs  to  be  done 
at  the  E.U.  level. 

One  positive  development  has  been  the  proposed  introduction 
of  the  European  Border  and  Coast  Guard  Agency,  which  could  help 


b  In  late  May  2016  Greek  police  evacuated  irregular  migrants  from  the 
Idomeni  camp  and  moved  them  to  other  facilities  in  Greece.  See  Costas 
Kantouris,  "Greek  police  evacuate  hundreds  from  Idomeni  refugee  camp," 
Associated  Press,  May  24,  2016. 


Kikilias  meets  with  Greek  police  officers  in  2014. 


protect  Greece’s  borders.'  This  is  something  that  we  should  move 
toward,  provided  it  is  done  in  such  a  way  that  respects  Greece’s 
sovereignty. 

Another  point  worth  making  is  that  recent  Islamic  State  plots 
and  attacks  in  Europe  have  tended  to  involve  European  citizens. 
One  of  the  problems  we’ve  faced  is  that  only  if  there  is  an  arrest 
warrant  or  Interpol  red-flag  warning  will  we  in  Greece  be  able  to 
apprehend  a  European  citizen  suspected  by  one  of  our  European 
partners  of  ties  to  terrorist  activity.  So  it’s  a  difficult  task  because  if 
you  can’t  make  arrests,  you  have  to  monitor  these  suspects.  That 
is  why  it  is  essential  that  we  share  information  across  Europe  and 
work  closely  together.  The  Brussels  attacks  demonstrated  we  have 
along  way  to  go. 

CTC:  How  can  the  international  community  ultimately  resolve 
the  migrant  issue? 

Kikilias:  It  can  only  be  resolved  if  there  is  a  resolution  to  the  con¬ 
flict  in  Syria  and  Iraq.  This  isn’t  an  easy  task.  Some  intelligence 
services  predict  it  will  last  another  10  years,  but  the  West  needs  to 
concentrate  all  its  effort  on  this.  It  will  also  be  necessary  to  convince 
Turkey  to  maintain  its  agreement  on  migration  with  the  European 
Union.  Given  the  current  political  climate  in  Turkey  and  the  depar¬ 
ture  of  Prime  Minister  Ahmet  Davutoglu,  there  are  some  questions 
about  the  future  of  this  agreement.  If  President  Erdogan  decides  to 
change  their  policy  and  allow  the  freedom  of  movement  for  the  ir¬ 
regular  migrants  to  pass  into  Greece  through  the  Aegean  Sea,  there 
is  a  high  probability  of  the  migrant  crisis  returning.  We  could  also 
see  surging  flows  if  there  are  further  security  breakdowns  elsewhere 
in  the  Middle  East,  for  example  Egypt. 

CTC :  What  was  the  nature  of  your  security  cooperation  with  the 
United  States  while  you  were  in  office,  and  how  do  you  see  the 
relationship  evolving  in  the  future? 


c  In  December  2015  the  European  Commission  proposed  the  creation  of  a 
new  European  border  and  coast  guard  agency  to  “Include  monitoring  and 
supervisory  responsibilities,  as  well  as  the  capacity  to  intervene  in  urgent 
situations  either  at  the  request  of  a  Member  State  or  when  a  Member  State 
is  unable  or  unwilling  to  act.”  The  Commission  proposed  the  new  agency 
“will  be  able  to  draw  on  a  pool  of  resources  which  are  placed  at  its  disposal 
by  the  Member  States  and  are  available  for  immediate  deployment." 

See  European  Commission  -  Fact  Sheet  European  Agenda  on  Migration: 
Securing  Europe's  External  Borders,”  December  15,  2015. 
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Kikilias:  When  I  was  overseeing  Greek  security  agencies,  we  had 
a  very  positive  relationship  with  the  U.S.  government,  which  un¬ 
derstood  the  strategic  need  to  assist  Greece.  The  partnership  grew 
from  our  common  interests  and  our  ability  to  have  honest  conversa¬ 
tions  and  deliver  on  agreements.  We  built  the  relationship  through 
joint  operations  and  sharing  intelligence.  Such  cooperation  is  the 
most  important  component  of  combating  the  security  threats  we 
face.  Terrorism  is  attacking  democracy’s  weaknesses,  and  we  have 
to  mobilize  democracy’s  strengths  by  working  together  to  antici¬ 
pate  problems  rather  than  to  react  to  them.  Intelligence  is  the  most 
precious  commodity  for  governments,  and  it  is  essential  to  share  it 
rather  than  keeping  it  in  silos. 

CTC:  In  recent  years  the  Greek  government  and  security  ser¬ 
vices  have  been  focused  on  ‘leftist’  and  ‘anarchist’  terrorism. 
Should  the  focus  now  be  on  Islamist  terrorism? 

Kikilias:  For  Greece,  domestic  terrorism  from  leftist/anarchist 
groups  has  been  the  cause  of  a  lot  of  bloodshed,  so  it  has  been  ap¬ 
propriate  for  us  to  focus  on  that.  But  the  rise  of  ISIS  [Islamic  State] 
and  Islamist  terrorism  has  changed  the  threat  picture  for  the  whole 
of  Europe,  and  it’s  important  to  bring  in  new  expertise  to  build  up 
capacity  in  the  intelligence  services  in  order  to  understand  the 
threat  and  how  to  deal  with  it. 

CTC:  What  is  the  concern  about  home-grown  radicalization  in 
Greece  and  the  threat  of  an  attack  by  Islamist  terrorists  inside 
Greece? 

Kikilias:  Home-grown  radicalization  is  not  a  major  problem  in 
Greece,  although  we  are  not  immune  to  some  of  the  currents  across 
Europe.  We  have  a  significant,  moderate,  Muslim  minority  that  is 
well-integrated  throughout  Greece.  Greece  has  not  been  a  target  of 
Islamist  terrorist  plots,  but  it  cannot  have  any  sense  of  complacency. 
We  are  well  aware  there  are  American,  British,  Russian,  and  other 
international  interests  in  Greece  that  Islamist  terrorists  might  seek 
to  target.  The  Islamic  State  is  more  focused  on  attacking  countries 
like  the  U.K.,  France,  and  Germany,  and  it  is  important  for  Greece 
to  do  everything  possible  to  share  intelligence  on  threats  with  our 
partners  in  this  regard. 

Five  years  ago,  no  one  would  have  predicted  the  scale  of  these 
attacks  in  the  heart  of  Europe.  Many  of  the  attackers  were  not 


Vassilios  Kikilias 


first-generation  immigrants  but  second-  or  third-generation  that 
many  assumed  would  have  integrated  into  Western  culture.  While 
Greece  has  recognized  the  importance  of  integrating  minorities,  we 
have  to  learn  from  lessons  we’ve  seen  in  Europe. 

CTC:  You  were  a  famous  basketball  player  in  Greece  that  rep¬ 
resented  your  country  at  the  national  level.  What  were  some  of 
the  lessons  you  took  from  your  basketball  career  in  overseeing 
Greece’s  police  and  intelligence  agencies? 

Kikilias:  I  was  not  the  best  basketball  player  as  far  as  my  individual 
skill  level,  but  I  was  the  best  teammate.  That  helped  win  champi¬ 
onships.  Michael  Jordan  was  a  phenomenal  basketball  player,  but 
he  wouldn’t  have  been  able  to  win  championships  without  the  help 
of  his  teammates.  That  is  something  I  had  to  do  in  office.  I  had  to 
find  the  right  team  and  build  the  relationships  with  the  right  people 
both  inside  the  Greek  government  as  well  as  with  other  allied  na¬ 
tions.  In  basketball,  we  would  study  and  analyze  our  opponents  pri¬ 
or  to  the  match  to  understand  who  they  are,  the  tools  they  use,  and 
what  their  goals  are.  This  is  the  same  strategy  we  can  apply  to  our 
fight  against  ISIS.  During  my  visit  with  the  U.S.  intelligence  agen¬ 
cies,  I  was  most  impressed  with  the  younger  analysts  who  spent 
countless  hours  conducting  deep  analyses  on  various  global  issues. 
This  culture  and  desire  is  something  I  would  like  to  see  replicated 
in  Greece.  CTC 
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The  Greek  Gateway  to  Jihad 

By  Ioannis  Mantzikos 


Greece  has  become  a  crossroads  for  extremists  trying 
to  reach  Syria  and  Iraq  from  Europe  and  for  fighters 
returning  home.  The  fact  that  several  members  of  the 
Paris  and  Brussels  attack  cell  transited  through  the 
Greek  island  of  Leros  illustrates  the  Islamic  State’s 
ability  to  exploit  refugee  flows  in  order  to  move  fighters 
into  Europe.  Although  Greece’s  migrant  crisis  has  eased 
recently,  a  persistent  economic  crisis  has  left  the  Greek 
government  with  limited  resources  and  capability  for 
border  security  and  counterterrorism  efforts.  At  a  time 
of  growing  radicalization  and  Islamist  extremist  activity 
within  Greece’s  own  borders,  this  has  led  to  concern 
that  the  Islamic  State  may  take  advantage  by  launching 
attacks  against  Western  or  Russian  tourists  or  interests 
on  Greek  soil. 


On  October  3,  2015,  a  boat  originating  from  nearby 
Turkey  carrying  almost  200  refugees  landed  on  the 
Greek  Cycladic  island  of  Leros.1  Among  them  were 
two  Iraqi  Islamic  State  recruits  carrying  Syrian 
passports  with  fake  names.2  They  were  among  the 
400-500  migrants  arriving  on  the  island  by  sea  every  day  last  fall3 
and  among  about  one  million  irregular  migrants4  who  have  come 
to  Europe  via  the  Aegean  sea,  many  on  rickety  boats  that  trawl  the 
Turkish  coast  seeking  out  the  desperate.4  Local  officials  processed 
the  duo  as  refugees,  and  then  the  two  men  booked  themselves  on 
a  ferry  to  Athens  before  transiting  through  the  Balkans  on  a  route 
trodden  by  tens  of  thousands  of  other  refugees.  Just  over  one  month 
later  they  blew  themselves  up  at  the  French  national  soccer  stadium 


a  Since  the  start  of  2014,  the  International  Organization  for  Migration  (I0M) 
calculates  that  almost  1.4  million  migrants  and  refugees  have  crossed  the 
Mediterranean  and  entered  Europe  via  one  of  five  E.U.  coastal  borders: 
Italy,  Greece,  Spain,  Cyprus,  and  Malta.  Through  March  16  of  this  year,  I0M 
counted  over  997,000  seaborne  arrivals  to  Greece  alone.  According  to  the 
Greek  authorities,  47  percent  of  newly  arrived  migrants  are  from  Syria,  27 
percent  from  Afghanistan,  17  percent  from  Iraq,  and  3  percent  each  from 
Iran  and  Pakistan.  See  “Mediterranean  Migrant  Arrivals  in  2016  Approach 
150,000;  Deaths  Reach  455,"  I0M,  March  11,  2016. 


Ioannis  Mantzikos  is  a  security  analyst  based  in  Athens,  Greece. 
He  is  a  Ph.D.  candidate  at  the  Free  State  University  in  South 
Africa  and  a  senior  analyst  at  the  Research  Institute  for  European 
and  American  Studies.  His  recent  book  with  Dr.  Denise  Baken  is 
entitled  The  Transformation  of  Al-Qaeda  in  the  Middle  East  and 
North  Africa.  Follow  @YMantzikos 


in  the  worst  terrorist  attack  in  France’s  modern  history. 

They  were  not  the  only  suspected  terrorists  who  landed  in  Leros 
that  day.  Two  others  posing  as  refugees  in  the  very  same  boat  were 
arrested  in  Austria  in  the  wake  of  the  Paris  attacks  under  suspicion 
of  having  ties  to  the  plotters.5  In  addition,  Leros  was  the  arrival 
point  in  September  for  Swedish  Islamic  State  operative  Osama 
Krayem  who  was  traveling  with  an  alleged  co-conspirator  in  the 
Paris  and  Brussels  terror  cell.6  There  were  also  eyewitness  sightings 
of  Paris  attack  ringleader  Abdelhamid  Abaaoud  in  Leros  in  the  late 
summer.  He  subsequently  claimed  to  have  exploited  refugee  flows 
to  enter  Europe,7  but  it  is  not  clear  if  Leros  was  his  entry  point.8 

The  Islamic  State’s  successful  infiltration  of  operatives  into 
Europe  through  Greece  cemented  concerns  that  the  country  had 
become  the  soft  underbelly  of  Europe.  An  unannounced,  on-site 
evaluation  by  E.U.  inspectors  of  six  Greek  sea  and  land  border  sites 
between  November  10  and  November  13,  2015,  (ironically,  the  day 
of  the  Paris  attacks)  revealed  “serious  deficiencies  in  the  carrying 
out  of  external  border  control  by  Greece,  in  particular  due  to  the 
lack  of  appropriate  identification  and  registration  of  irregular  mi¬ 
grants  at  the  islands,  of  sufficient  staff,  and  of  sufficient  equipment 
for  verifying  identity  documents.”9  b 

After  reaching  a  crisis  point,  the  migrant  pressures  on  Greece 
eased  dramatically  after  March  2016  due  to  an  agreement  between 
the  European  Union  and  Turkey  to  deport  irregular  migrants  back 
to  Turkey10  and  the  move  by  several  countries  in  the  Balkans  along 
the  so-called  northern  refugee  corridor  to  restrict  severely  the  ad¬ 
mission  of  refugees  trying  to  transit  northward.11  But  there  is  con¬ 
cern  that  the  numbers  coming  through  Greece  may  surge  again  if 
the  deal  with  Turkey  collapses. 

Transit  Route 

An  early  example  of  a  terrorist  crossing  through  Greece  was  Ibra¬ 
him  Boudina,  a  French  Islamic  State  operative  who  was  detained 
on  January  3,  2014,  after  Greek  police  pulled  over  a  taxi  in  which  he 


b  E.U.  Migration  and  Home  Affairs  Commissioner  Dimitris  Avramopoulos 
stated  in  January,  “we  know  that  in  the  meantime  Greece  has  started 
undertaking  efforts  towards  rectifying  and  complying  with  the  Schengen 
rules.  Substantial  improvements  are  needed  to  ensure  the  proper 
reception,  registration,  relocation  or  return  of  migrants  in  order  to  bring 
Schengen  functioning  back  to  normal,  without  internal  border  controls. 

This  is  our  ultimate  common  goal.”  "Commission  discusses  draft  Schengen 
Evaluation  Report  on  Greece,”  European  Commission  Press  Release, 
Brussels,  January  27, 2016. 

c  According  to  the  I0M,  3,360  migrants  and  refugees  landed  on  the  Greek 
islands  in  April  2016  as  compared  to  26,971  the  previous  month— an  88 
percent  drop.  The  figures  for  May  were  lower  still  with  just  1,465  migrants 
and  refugees  arriving  on  Greek  shores  by  sea,  fewer  than  were  arriving  daily 
in  January  and  February.  See  “‘Dramatic'  drop  in  migrant  arrivals  to  Greece: 
officials,”  Deutsche  Welle,  May  13,  2016;  “IOM:  Noted  drop  of  maritime 
migrants  reaching  Greece,”  Xinhua,  June  4,  2016. 
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was  traveling  in  the  town  of  Orestiada,  four  miles  from  the  Turkish 
border.  Greek  police  discovered  a  USB  drive  with  instructions  for 
how  to  make  homemade  bombs  “in  the  name  of  Allah,”  but  let  him 
go  because,  just  as  with  Fabien  Clain,  there  was  no  warrant  for  his 
arrest,  despite  French  intelligence  services  being  aware  of  his  travel 
to  Syria.  One  month  later  French  police  arrested  him  near  Cannes, 
thwarting  his  alleged  plans  to  carry  out  a  bomb  attack  with  three 
soda  cans  filled  with  the  explosive  TATP.12 

Another  case  was  Fabien  Clain,  one  of  the  alleged  masterminds 
of  the  Paris  attacks,  who  reportedly  transited  through  Greece  on 
his  way  to  Syria  in  the  early  months  of  2015.  Clain  drove  his  family 
from  the  northwestern  port  of  Igoumenitsa  to  the  Turkish  border  in 
the  northeast  of  the  country,  making  stops  in  both  Thessaloniki  and 
Kavala.  French  authorities  tipped  off  their  Greek  counterparts  of  his 
presence  in  the  country,  but  there  was  no  warrant  for  his  arrest  so 
he  was  not  detained.13  d 

A  significant  number  have  transited  from  Balkan  countries  such 
as  Kosovo  and  Albania  and  then  used  Greece  as  a  gateway  to  jihad." 
A  case  in  point  was  Mirsad  Bektasevic,  a  Bosnian-Swede  who  was 
arrested  along  with  another  man  in  Evros,  Greece,  on  January  28, 
201 6.M  Bektasevic  was  previously  implicated  in  a  plot  to  attack  the 
British  Embassy  in  Sarajevo/ A  file  collected  by  Greek  authorities 
showed  that  both  suspects  came  to  Athens  via  Sweden  on  January 
22,  2016,  for  two  days  before  continuing  on  their  journey  to  exit 
European  territory  by  the  end  January  2016. 15  Authorities  were 
alerted  of  their  arrival  at  Athens  airport  by  a  tipoff  from  a  Euro¬ 
pean  intelligence  service.  From  there,  both  men  took  a  KTEL  bus 
to  Thessaloniki  and  arrived  at  Alexandroupolis  on  a  second  bus. 
The  ‘green  light’  for  their  arrest  came  when  they  booked  a  ticket  for 
Tychero,  a  town  near  the  Turkish  border.16 

Some  have  used  Greece  as  a  way  station  to  transport  weapons 
into  Syria.  In  February  2016  Greek  police  arrested  three  alleged 
British  jihadis  of  Kurdish  descent  in  Evros  in  northeastern  Greece 
who  may  have  been  seeking  to  cross  into  Turkey.17  Police  discov¬ 
ered  a  significant  number  of  weapons  in  their  possession  and  over 
200,000  rounds  of  ammunition.18 

In  order  to  facilitate  travel  flows,  militants  have  set  up  logistical, 
recruitment,  and  financial  cells  in  Greece,  and  some  members  of 
Greece’s  large  immigrant  community,  particularly  in  Athens,  have 
provided  housing  to  the  transiting  jihadis  and  helped  them  evade 
security  services.19 


d  Fabien  Clain  had  previously  served  jail  time  for  recruiting  for  al-Qa'ida  in 
Iraq.  As  well  as  claiming  the  Paris  attacks  on  behalf  of  the  Islamic  State,  he 
was  also  suspected  of  encouraging  a  plot  by  a  Parisian  student  to  attack  a 
church  in  the  city,  which  was  thwarted  in  April  2015.  Paul  Cruickshank  and 
Tim  Lister,  “Immense  challenges  remain  despite  arrests  of  terror  suspects," 
CNN,  April  8, 2016. 

e  The  Islamic  State  has  produced  several  propaganda  videos  featuring 
Kosovars  appealing  to  their  countrymen  to  join  them,  and  the  Kosovo 
authorities  believe  some  200  individuals  have  left  to  wage  jihad  in  Iraq  and 
Syria.  See  Tim  Lister  and  loannis  Mantzikos,  “Add  this  to  Greece's  list  of 
problems:  It's  an  emerging  hub  for  terrorists,”  CNN,  January  26,  2015. 

f  On  October  19, 2005,  Bektasevic  had  been  arrested  after  a  police  raid  on 
his  aunt’s  home  in  Sarajevo,  Bosnia.  In  the  house,  police  had  found  a  belt 
with  explosives,  18  kilograms  of  explosives,  and  a  videotape  with  directions 
as  to  how  to  create  a  makeshift  bomb.  See  Rodolfo  Toe,  “Sarajevo  Embassy 
Attack  Plotter  Held  in  Greece,"  Balkan  Insight,  February  2, 2016,  and  Maja 
Zuvela,  “Three  jailed  in  Bosnia  for  planning  suicide  attack,"  Reuters,  January 
10,  2007. 


“Hie  terrorist  arrivals  in  Leros  last  fall 
made  clear  that  Greece  has  also  been  a 
transit  point  for  a  significant  number 
of  European  extremists  returning 
from  Syria.” 


Islamic  State  operatives  have  used  Greece  to  coordinate  attack 
plots  in  Europe.  The  Paris  attacks  ringleader  Abdelhamid  Abaaoud 
communicated  by  a  cell  phone  from  an  Athens  apartment  with  sev¬ 
eral  members  of  an  Islamic  State  cell  in  Belgium,  plotting  a  major 
gun  and  bomb  attack.  Plans  for  how  to  attack  airports  were  re¬ 
portedly  discovered  on  a  computer  in  his  residence  on  Asteropolis 
Road  in  the  heart  of  the  capital.20  The  plot  was  thwarted  in  a  gun 
battle  in  Venders,  Belgium,  in  January  2015.  An  Algerian  associate 
of  Abaaoud  in  Athens  was  extradited  to  Belgium  and  charged  with 
being  part  of  the  conspiracy.21 

The  Threat  to  Greece 

Greece  does  not  have  as  significant  a  problem  with  radicalization 
as  some  other  European  countries,  which  means  the  threat  from 
homegrown  Islamist  terrorism  is  significantly  lower  than  in  France 
or  the  United  Kingdom.  Greece  hosts  a  Muslim  minority,  which  is 
a  vestige  of  the  Ottoman  Empire,  but  also  an  expanding  Islamic 
population  from  Arab  countries  and  South  Asia  who  have  arrived 
in  significant  numbers  as  illegal  immigrants.  Estimates  of  the  cen¬ 
turies-old8  Muslim  minority11— which  is  mostly  located  in  west¬ 
ern  Thrace,  a  region  bordering  Bulgaria  and  Turkey— range  from 
98,000  to  140,000  (between  0.9  percent  and  1.2  percent  of  Greece’s 
11  million  population  but  as  much  as  a  quarter  of  the  population 
of  western  Thrace).  Estimates  for  immigrant  Muslim  community 
numbers  between  200,000  and  300,000  (between  1.9  percent  and 
2.7  percent)  with  the  majority  living  in  the  Athens  region.  Most 
Albanian  immigrants  to  Greece  are  Muslims,  though  most  are  sec¬ 
ular-leaning.22  While  there  are  low  rates  of  radicalization  among 
the  very  longstanding  Muslim  minority  in  western  Thrace,  most 
of  whom  are  secular-leaning,* 1  there  is  concern  about  radicalization 
among  immigrant  communities. 

One  concern  is  the  lack  of  registered  mosques  in  areas  where 
there  are  large  immigrant  Muslim  populations  like  Athens,  creating 


g  The  first  Muslims  settled  in  this  region  after  arriving  from  Anatolia  in 
1363  during  an  attempted  conquest  of  Europe  by  the  Ottoman  Turks.  In 
1923  Greece  and  Turkey  agreed  to  a  mass  exchange  of  populations  and 
consequently  Greeks  resettled  from  Asia  Minor  to  mainland  Greece  and 
vice  versa.  The  Muslim  minority  in  Thrace  is  mirrored  by  a  Greek-Orthodox 
minority  in  Istanbul.  See,  for  example,  loannis  Michaletos,  “Islam  in  Greece: 
Country  Outlook,"  Radical  Islam  Monitor  in  Southeast  Europe,  August  5, 
2011. 

h  It  is  estimated  that  45  percent  of  Muslims  in  Western  Thrace  are  of  Turkish 
descent,  40  percent  of  Slavic  descent,  and  15  percent  of  “Pomak”  descent, 
loannis  Michaletos,  “Islam  in  Greece:  Country  Outlook,”  Radical  Islam 
Monitor  in  Southeast  Europe,  August  5, 2011. 

i  Muslim  preachers  in  the  area  of  Komotini  in  the  Evros  region  of  northern 
Greece  have  repeatedly  denounced  radical  extremism  and  have  been 
supportive  of  all  counterterrorism  measures.  “Thraki  Muftis  denounce 
ISIS," To  Vima,  October  1, 2014. 
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a  potential  informational  black  hole  for  authorities.  Data  from  the 
Muslim  Association  of  Greece  shows  that  there  are  currently  three 
officially  registered  mosques  in  Athens  and  about  20-25  unofficial 
mosques  serving  the  city’s  estimated  130,000-200,000  Muslims.23 
The  presence  of  informal,  unregistered  mosques  has  complicated 
the  task  of  law  enforcement  officials  in  investigating  suspected  for¬ 
eign  fighter  cases.24 

Some  Greek  Muslims  have  tried  to  travel  to  Syria  via  Komotini, 
a  western  Thrace  town  near  the  border  with  Bulgaria  and  Turkey. 
One  example  was  a  40-year-old  seller  of  ecclesiastical  parapher¬ 
nalia  in  Komotini25  who,  according  to  police  sources,  operated  a 
pro-jihadist  Facebook  profile.26 

In  another  example  of  extremist  activity  within  Greece,  an  in¬ 
vestigation  into  Rawti  Shax,  an  Islamic  State  linked-organization 
headed  by  an  Iraqi  Kurdish  cleric  based  in  Norway,  revealed  the 
group  was  trying  to  recruit  from  Greece.  In  November  2015  Eu¬ 
ropean  authorities  arrested  15  people  in  four  European  countries, 
breaking  up  what  officials  called  a  terrorist  network  that  sought  to 
overthrow  the  Kurdish  government  in  northern  Iraq  and  recruit 
militants  to  fight  in  Iraq  and  Syria.27  According  to  Greek  police,  an 
Algerian  national  and  a  Pakistani  who  were  residents  of  Norway 
and  involved  in  the  network  spent  time  in  Greece  for  recruitment 
purposes.28  An  analysis  of  internet  chatroom  activity  also  indicated 
the  group  had  supporters  in  Greece.29 

With  thousands  of  Syrian  refugees  stranded  in  Greece  after  Bal¬ 
kan  countries  took  measures  to  shut  off  transit  routes  for  irregular 
migrants  in  March,  there  is  concern  refugee  camps  could  become 
a  breeding  ground  for  extremism.30  Before  it  was  shut  down  last 
month,  the  Idomeni  camp  in  northern  Greece  had  swelled  to  over 
10,000  migrants.  Greek  police  have  since  moved  the  refugees  to 
other  facilities  in  Greece.31 

There  is  concern  that  because  of  the  jihadist  transit  through  the 
country,  the  Islamic  State  may  try  to  set  up  sleeper  cells  in  Greece 
and  that  these  cells  might  take  advantage  of  limited  Greek  counter¬ 
terrorism  capabilities  to  launch  attacks  against  Western  or  Russian 
visitors  or  interests  inside  the  country.  As  many  as  27-5  million  tour¬ 
ists  are  expected  to  visit  Greece  in  2016,  almost  triple  the  country’s 
population.32  As  a  member  of  NATO  Greece  itself  is  also  in  the  Is¬ 
lamic  State’s  crosshairs,  even  if  the  country  is  not  likely  a  priority 
target.  In  the  wake  of  the  Paris  attacks  the  Islamic  State  released  a 
video  threatening  reprisals  in  60  countries  that  it  considered  allied 
against  it,  including  Greece.33 

Limited  Counterterrorism  Capabilities 

The  rise  of  Islamist  radicalization  and  the  transit  of  European  for¬ 
eign  fighters  through  Greece  has  been  in  danger  of  overwhelming 
security  services  such  as  the  Greek  National  Security  Agency  (EYP), 
which  was  established  to  confront  left-wing  terrorist  groups  like  the 


Revolutionary  Organization  17  November.  Most  of  its  staff  comes 
from  various  bodies  such  as  the  police  (drug  enforcement),  coast 
guard,  and  military  intelligence.34  Greek  ministers  have  criticized 
EYP’s  leadership)  and  a  lack  of  funding  and  training  has  made  it 
extremely  reliant  on  help  from  other  Western  intelligence  services.35 
Greek  police  also  lack  capabilities  to  track  jihadis.  When  Belgian 
authorities  requested  Greek  authorities  arrest  Abaaoud  in  Athens 
in  early  2015,  Belgian  officials  accused  Greek  police  of  failing  to 
move  quickly  enough.36 

There  have  been  some  positive  developments,  including  a  recent, 
dramatic  reduction  in  the  number  of  migrants  entering  Greece,  and 
E.U.  officials  have  proposed  creating  a  European  border  security 
force  and  coast  guard  to  help  Greece.37  In  addition,  the  newly  estab¬ 
lished  European  Migrant  Smuggling  Center  (EMSC)  has  stationed 
officers  on  the  islands  of  Chios,  Samos,  Lesvos,  and  Leros  where 
refugee  registration  centers  are  in  operation,  as  well  as  in  Pirae¬ 
us  Port,  bolstering  Greece’s  current  border-security  capabilities. 
EMSC  agents  are  checking  suspicious  individuals  against  Europol’s 
databases  in  the  Netherlands.38 

Conclusion 

Although  the  migrant  crisis  has  eased,  a  sustained  economic  crisis 
has  left  the  Greek  government  with  limited  resources  and  capacity 
for  border  security  and  counterterrorism  efforts  at  a  time  of  grow¬ 
ing  radicalization  and  militant  activity  within  Greece’s  own  bor¬ 
ders.  If  thousands  of  migrant  seekers  remained  trapped  in  military 
camps  in  Greece  for  a  lengthy  period  there  is  a  possibility  some  will 
be  radicalized.39  Rising  anti-immigrant  activism  by  militants  from 
Greece’s  far-right  Golden  Dawn  party  risks  adding  fuel  to  the  fire. 

There  is  concern  that  the  Islamic  State  may  take  advantage  by 
launching  attacks  against  Western  or  Russian  interests  on  Greek 
soil.  Moreover,  there  is  a  sense  of  complacency  that  Greece  will  not 
be  struck  because  it  is  not  playing  any  role  in  the  coalition  against 
the  Islamic  State,  which  is  partly  due  to  its  financial  restraints  but 
also  due  to  the  fact  that  the  governing  Syriza  party  hails  from  an 
anti-war  rhetoric  movement.40  It  may  only  be  an  attack  in  Greece 
itself  that  leads  to  a  wake-up  call. 


j  Former  Minister  of  Interior  Yiannis  Panousis  said  he  was  aware  that 
jihadis  were  traveling  via  Greece  and  questioned  EYP's  ability.  Minister  of 
Defence  Panos  Kammenos  called  for  EYP  Head  Mr.  Yiannis  Roubatis  to 
resign.  See  Constantinos  Zoulas  and  Yiannis  Souliotis,  Panousis  claims 
SYRIZA  officials  told  him  to  free  detained  suspects,  Kathimerini,  November 
15,  2015;  “Kammenos:  Roubatis  should  have  resigned,"  Huffington  Post 
Greece,  November  22, 2015. 
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How  Terrorists  Use  Encryption 

By  Robert  Graham 


As  powerful  encryption  increasingly  becomes  embedded 
in  electronic  devices  and  online  messaging  apps,  Islamist 
terrorists  are  exploiting  the  technology  to  communicate 
securely  and  store  information.  Legislative  efforts  to  help 
law  enforcement  agencies  wrestle  with  the  phenomenon 
of  “going  dark”  will  never  lead  to  a  return  to  the  status 
quo  ante,  however.  With  the  code  underlying  end-to-end 
encryption  now  widely  available,  unbreakable  encryption 
is  here  to  stay.  However,  the  picture  is  not  wholly  bleak. 
While  end-to-end  encryption  itself  often  cannot  be 
broken,  intelligence  agencies  have  been  able  to  hack 
the  software  on  the  ends  and  take  advantage  of  users’ 
mistakes. 


Counterterrorism  officials  have  grown  increasingly 
concerned  about  terrorist  groups  using  encryption  in 
order  to  communicate  securely.  As  encryption  increas¬ 
ingly  becomes  a  part  of  electronic  devices  and  online 
messaging  apps,  a  range  of  criminal  actors  including 
Islamist  terrorists  are  exploiting  the  technology  to  communicate 
and  store  information,  thus  avoiding  detection  and  incrimination, 
a  phenomenon  law  enforcement  officials  refer  to  as  “going  dark.” 

Despite  a  vociferous  public  debate  on  both  sides  of  the  Atlantic 
that  has  pitted  government  agencies  against  tech  companies,  civil 
liberties  advocates,  and  even  senior  figures  in  the  national  security 
establishment  who  have  argued  that  creation  of  “backdoors”1  for  law 
enforcement  agencies  to  retrieve  communications  would  do  more 
harm  than  good,  there  remains  widespread  confusion  about  how 
encryption  actually  works.1* 

Technologists  have  long  understood  that  regulatory  measures 
stand  little  chance  of  rolling  back  the  tide.  Besides  software  being 
written  in  other  countries  (and  beyond  local  laws),  what  has  not 
been  fully  understood  in  the  public  debate  is  that  the  “source  code” 


a  For  example,  General  Michael  Hayden,  the  former  head  of  the  NSA  and  CIA, 
stated  “America  is  more  secure— America  is  more  safe— with  unbreakable 
end-to-end  encryption,"  arguing  that  the  vulnerabilities  created  by 
removing  unbreakable  code  outweighed  the  advantages  of  detecting 
nefarious  communications.  Tom  Di  Christopher,  “US  safer  with  fully 
encrypted  phones:  Former  NSA/CIA  chief,"  CNBC,  February  23,  2016. 


Robert  Graham  is  a  specialist  in  cyber  security,  who  created  the 
first  intrusion  prevention  system  (IPS).  He  is  the  creator  of  the 
cyber  security  tools  BlackICE,  sidejacking,  and  masscan,  and  he 
authors  the  blog  Errata  Security.  Follow  @erratarob 


itself  behind  end-to-end  encryption  is  now  widely  available  online, 
which  means  that  short  of  shutting  down  the  internet,  there  is  noth¬ 
ing  that  can  be  done  to  stop  individuals,  including  terrorists,  from 
creating  and  customizing  their  own  encryption  software. 

The  first  part  of  this  article  provides  a  primer  on  the  various 
forms  of  encryption,  including  end-to-end  encryption,  full  device 
encryption,  anonymization,  and  various  secure  communication 
(operational  security  or  opsec)  methods  that  are  used  on  top  of  or 
instead  of  encryption.  Part  two  then  looks  at  some  examples  of  how 
terrorist  actors  are  using  these  methods. 

Part  1:  Encryption  101 

End-to-End  Encryption 

A  cell  phone  already  uses  encryption  to  talk  to  the  nearest  cell  tower. 
This  is  because  hackers  could  otherwise  eavesdrop  on  radio  waves 
to  listen  in  on  phone  calls.  However,  after  the  cell  tower,  phone 
calls  are  not  encrypted  as  they  traverse  copper  wires  and  fiber  optic 
cables.  It  is  considered  too  hard  for  nefarious  actors  to  dig  up  these 
cables  and  tap  into  them. 

In  a  similar  manner,  older  chat  apps  only  encrypted  messages  as 
far  as  the  servers,  using  what  is  known  as  SSL.b  That  was  to  defeat 
hackers  who  would  be  able  to  eavesdrop  on  internet  traffic  to  the 
servers  going  over  the  Wi-Fi  at  public  places.  But  once  the  messag¬ 
es  reached  the  servers,  they  were  stored  in  an  unencrypted  format 
because  at  that  point  they  were  considered  “safe”  from  hackers.  Law 
enforcement  could  still  obtain  the  messages  with  a  court  order. 

Newer  chat  apps,  instead  of  encrypting  the  messages  only  as  far 
as  the  server,  encrypt  the  message  all  the  way  to  the  other  end,  to 
the  recipient’s  phone.  Only  the  recipients,  with  a  private  key,  are 
able  to  decrypt  the  message.  Service  providers  can  still  provide  the 
“metadata”  to  police  (who  sent  messages  to  whom),  but  they  no 
longer  have  access  to  the  content  of  the  messages. 

The  online  messaging  app  Telegram  was  one  of  the  earliest  sys¬ 
tems  to  support  end-to-end  encryption,  and  terrorists  groups  such 
as  the  Islamic  State  took  advantage.2  These  days,  the  feature  has 
been  added  to  most  messaging  apps,  such  as  Signal,  Wickr,  and 
even  Apple’s  own  iMessage.  Recently,  Facebook’s  WhatsApp3  and 
Google4  announced  they  will  be  supporting  Signal’s  end-to-end  en¬ 
cryption  protocol. 


b  Secure  Sockets  Layer  (SSL)  is  the  standard  security  technology  that  is 
used  for  creating  an  encrypted  link  between  a  web  server  and  internet 
applications  such  as  browsers  and  chat  apps.  This  prevents  anyone  who  is 
eavesdropping  on  the  network  from  reading  the  original,  unencrypted  data. 
Only  those  on  either  end  of  the  SSL  link  can  read  the  data. 
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On  personal  computers,  the  software  known  as  PGP/  first  creat¬ 
ed  in  the  mid-1990s,  reigns  supreme  for  end-to-end  encryption.  It 
converts  a  message  (or  even  entire  files)  into  encrypted  text  that  can 
be  copy/pasted  anywhere,  such  as  email  messages,  Facebook  posts, 
or  forum  posts.  There  is  no  difference  between  “military  grade  en¬ 
cryption”  and  the  “consumer  encryption”  that  is  seen  in  PGP.  That 
means  individuals  can  post  these  encrypted  messages  publicly  and 
even  the  NSA  is  unable  to  access  them.  There  is  a  misconception 
that  intelligence  agencies  like  the  NSA  are  able  to  crack  any  encryp¬ 
tion.  This  is  not  true.  Most  encryption  that  is  done  correctly  cannot 
be  overcome  unless  the  user  makes  a  mistake. 

Such  end-to-end  encryption  relies  upon  something  called  pub¬ 
lic-key  cryptography.  Two  mathematically  related  keys  are  created, 
such  that  a  message  encrypted  by  one  key  can  only  be  decrypted  by 
the  other.  This  allows  one  key  to  be  made  public  so  that  one’s  inter¬ 
locutor  can  use  it  to  encrypt  messages  that  the  intended  recipient 
can  decrypt  through  the  private-key.11  Al-Qa '  ida  s  Inspire  magazine, 
for  example,  publishes  its  public-key5  so  that  anyone  using  PGP  can 
use  it  to  encrypt  a  message  that  only  the  publishers  of  the  magazine 
can  read. 

Full  Device  Encryption 

If  an  individual  loses  his  iPhone,  for  example,  his  data  should  be  safe 
from  criminals.6  Only  governments  are  likely  to  have  the  resources 
to  crack  the  phone  by  finding  some  strange  vulnerability.  The  FBI 
reportedly  paid  a  private  contractor  close  to  $1  million  to  unlock  the 
iPhone  of  San  Bernardino  terrorist  Syed  Rizwan  Farook.6 

The  reason  an  iPhone  is  secure  from  criminals  is  because  of  full 
device  encryption,  also  full  disk  encryption.  Not  only  is  all  of  the 
data  encrypted,  it  is  done  in  a  way  that  is  combined  or  entangled7 
with  the  hardware.  Thus,  the  police  cannot  clone  the  encrypted 
data,  then  crack  it  offline  using  supercomputers  to  “brute-force” 
guess  all  possible  combinations  of  the  passcode.  Instead,  they  ef¬ 
fectively  have  to  ask  the  phone  to  decrypt  itself,  which  it  will  do  but 
slowly,  defeating  cracking/ 

Android  phones  work  in  much  the  same  manner.  However,  most 
manufacturers  put  less  effort  into  securing  their  phones  than  Apple. 
Exceptions  are  companies  like  Blackphone,  which  explicitly  took 
extra  care  to  secure  their  devices. 


c  PGP,  or  Pretty  Good  Privacy,  was  software  written  in  the  1990s  for 
encrypting  any  information,  though  primarily  emails.  A  version  known 
as  GPG,  or  Gnu  Privacy  Guard,  exists,  which  is  open-source,  meaning 
anyone  can  download  the  code  and  build  their  own  apps  that  include  this 
encryption  standard. 

d  The  most  common  use  of  PGP  involves  the  creation  of  two  extremely  large 
prime  numbers,  then  multiplies  them  together.  The  original  two  numbers 
form  the  private-key,  the  multiplied  result  forms  the  public-key  that  anyone 
can  know.  It  is  secure  because  it  is  too  difficult  for  even  the  most  powerful 
supercomputer  to  work  backward  and  discover  the  original  primes  from 
the  public-key.  The  public-key  is  then  posted  to  public-key  servers  so  that 
if  somebody  knows  the  associated  email  address,  they  can  find  the  key. 

Or  the  key  can  be  sent  directly  in  an  email  message,  and  the  recipient  can 
then  use  the  public-key  to  encrypt  messages  that  only  the  other  party  can 
decrypt. 

e  This  is  assuming  the  owner  is  using  the  newer  iOS  9  operating  system  as 
hackers  found  vulnerabilities  in  earlier  versions. 

f  The  precise  delay  is  80  milliseconds,  or  12  guesses  per  second.  If  the 
passcode  is  “1234,”  it  will  be  guessed  quickly.  But  if  the  passcode  uses  six 
alphanumeric  characters,  it  will  take  more  than  five  years  to  guess  it. 


“A  survey  of  terrorist  publications  and 
details  from  interrogations  suggest 
that  terrorists  are  at  least  as  concerned 
about  hiding  metadata  as  they  are 
about  encrypting  communications.” 


Full  disk  encryption  is  also  a  feature  of  personal  computers. 
Microsoft  Windows  comes  with  BitLocker,  Macintosh  comes  with 
FileVault,  and  Linux  comes  with  LUKS.  The  well-known  disk  en¬ 
cryption  software  TrueCrypt  works  with  all  three  operating  systems 
as  does  a  variation  of  PGP  called  PGPdisk.  Some  computers  come 
with  a  chip  called  a  TPMR  that  can  protect  the  password  from  crack¬ 
ing,  but  most  owners  do  not  use  a  TPM.  This  means  that  unless 
they  use  long/complex  passwords,  adversaries  will  be  able  to  crack 
their  passwords. 

These  programs  can  also  produce  volume  or  container  files.  They 
will  exist  as  a  normal  file  on  the  disk,  like  foobar.dsk.  But  the  con¬ 
tents  of  this  file  will  look  like  random  gibberish.  When  the  file  is 
opened  with  the  encryption  software,  it  will  appear  as  a  disk  drive 
(like  F:)  on  the  computer.  Anything  written  to  this  virtual  drive  F: 
will,  in  fact,  be  encrypted  and  written  to  foobar.dsk. 

Anonymization 

In  2013,  Edward  Snowden  released  documents  from  the  NSA8  re¬ 
vealing  widespread  mass  surveillance,  even  of  U.S.  citizens.  This 
surveillance  did  not  eavesdrop  on  the  phone  calls  of  people  in  the 
United  States  but  instead  collected  the  metadata  about  the  calls: 
who  was  calling  whom  and  for  how  long.  Reportedly9  the  United 
States  has  targeted  overseas  terrorists  with  drone  strikes  based  on 
this  metadata.  A  survey  of  terrorist  publications  and  details  that 
have  emerged  from  interrogations  suggest  that  terrorists  are  at  least 
as  concerned  about  hiding  metadata  as  they  are  about  encrypting 
communications.  But  the  various  chat  apps/services  now  available 
on  the  market  do  little  to  hide  metadata.  Servers  must  know  the 
address  or  phone  number  in  order  to  know  where  to  forward  the 
message. 

The  most  common  way  to  deal  with  this  problem  on  the  internet 
is  through  a  service  called  Tor  (The  Onion  Router)/  It  passes  traf¬ 
fic  (encrypted)  through  multiple  proxy  servers  around  the  internet 
controlled  by  different  organizations,  often  private  individuals.  This 
makes  it  sometimes  very  difficult  and  at  times  even  impossible  to 
figure  out  the  source  of  network  traffic. 

The  process  is  not  perfect.  For  example,  when  the  FBI  went  af¬ 
ter  Jeremy  Hammond,  the  perpetrator  of  the  Anonymous  Stratfor 
attack,  they  collected10  traffic  on  both  ends.  The  Tor  traffic  coming 
from  his  home  matched  activity  by  the  targeted  hacker  in  a  chat 


g  Trusted  Platform  Module  stores  the  encryption  keys  in  the  hardware, 

similar  to  how  phones  store  keys  in  their  hardware.  It  also  provides  physical 
protection  for  the  keys  so  that  no  one  can  crack  open  the  chip  to  access 
them. 

h  Tor  runs  on  Windows,  Macintosh,  and  Linux  computers.  It  is  mostly  used 
with  its  own  built-in  web  browser  based  on  Firefox,  but  it  can  be  used  to 
proxy  almost  any  internet  traffic. 
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room.  The  correlation  was  robust  enough  to  secure  court  orders. 

Tor  also  requires  great  care  to  use.  The  leader  of  the  Anonymous 
faction  called  “LulzSec”  was  discovered11  because  one  time  when  he 
logged  onto  a  chat  room,  he  forgot  to  enable  Tor  first.  This  one  time 
that  he  slipped  up  defeated  the  hundreds  of  times  he  did  it  right, 
revealing  his  internet  address  to  police. 

As  the  Snowden  leaks  revealed,12  Tor  is  a  double-edged  sword  for 
intelligence  services.  Reportedly,  U.S.  government  agencies  had  a 
role  in  Tor’s  development,  have  provided  funding  for  it,  and  have 
used  it  to  hide  their  own  activities.  Yet  intelligence  agencies  spend 
significant  resources  trying  to  defeat  it  when  terrorists  use  it.13 

Opsec  Methods 

Encryption  is  only  one  way  of  hiding.  There  are  alternatives.  For  ex¬ 
ample,  the  Paris  terrorists  congregated  in  safe  houses  in  Belgium  to 
plan  their  attack,  and  while  some  had  downloaded  messaging  apps 
with  encryption,  to  a  significant  degree  they  used  burner  phones14  to 
coordinate  during  the  attack.'  To  describe  this,  technologists  often 
use  the  word  opsec,  or  operational  security. 

Most  chat  apps  (like  Telegram  and  Wickr)  now  have  a  feature 
where  old  messages  automatically  self-destruct  after  an  hour  or  a 
day,  as  well  as  the  option  to  manually  delete  messages.  It  means 
incriminating  evidence  disappears  without  any  interaction  by  the 
user.  For  law  enforcement,  this  can  mean  that  when  a  terrorist’s 
phone  is  obtained,  most  of  the  evidence  may  already  be  gone.  On 
desktops/laptops,  there  is  special  software,  such  as  “Windows 
Washer”  on  Windows,  for  wiping  the  disks,  designed  to  get  rid  of 
any  remaining  information.  It  is  also  a  feature  on  web  browsers, 
which  can  automatically  delete  browser  history. 

One  industry  leader  for  opsec  is  “Tails,”  which  is  frequently  men¬ 
tioned  on  terrorist  forums.15  It  contains  all  the  encryption  tools  de¬ 
scribed  in  this  paper  and  more.  Tails  is  a  live  flash  drive,  which 
means  when  a  user  inserts  it  into  the  computer,  no  trace  is  left  on 
the  computer.  A  typical  computer  boots  Windows  or  Linux  or  ma- 
cOS  because  the  operating  system  is  on  the  internal  drive.  When  a 
live  USB  drive  is  inserted,  however,  the  computer  can  instead  boot 
the  operating  system  from  the  external  drive,  ignoring  whatever 
operating  system  is  on  the  internal  drive. 

Tails  boots  the  Linux  operating  system,  which  is  similar  to  Win¬ 
dows  or  Mac  OS  in  most  ways.  It  is  a  bit  clunky  but  easy  enough  to 
use.  Most  importantly,  it  reduces  the  chance  that  the  user  will  make 
a  mistake  because  once  the  USB  drive  is  removed  and  the  computer 
is  shut  down,  there  will  be  no  accidental  evidence  left  behind.  Tails 
includes  a  normal  web  browser  like  Firefox  that  runs  through  Tor. 
It  includes  PGP  and  Pidgen+OTRfor  end-to-end  encrypted  email/ 
messages.  It  includes  LUKS  (Linux  Unified  Key  Setup)  for  full  disk 
encryption  of  the  USB  drive,  so  that  even  if  the  user  loses  it,  no  one 
will  be  able  to  decrypt  the  lost  drive. 


i  The  three  Paris  attack  teams  kept  in  touch  with  each  other  by  burner 
phones  during  the  night  of  the  attacks.  The  trio  of  terrorists  who  attacked 
the  Bataclan  music  hall  downloaded  the  Telegram  encryption  messaging 
app  onto  their  phones  several  hours  before  the  attack,  but  they  also  made 
unencrypted  calls  and  text  messages  to  co-conspirators  on  burner  phones. 
Paul  Cruickshank,  “The  inside  story  of  the  Paris  and  Brussels  attacks,” 
CNN,  March  30,  2016. 


a*t>u~,yi 


qjtjoLuJI  jl  pul 


SECURE  COMMUNICATION 

oR^iJI  oAJI 
Loading... 


Mujahedeen  Secrets  logo  (Inspire  magazine ) 

Part  2:  How  Terrorists  Use  Encryption 

Encryption  in  the  Age  ofal-Qa  'ida 

In  the  years  after  9/11  U.S.  intelligence  intercepts  helped  thwart  a 
string  of  al-Qa '  ida  plots,  including  the  2006  transatlantic  airplane 
plot,  a  plot  by  al-Qa 'ida-linked  terrorists  to  bomb  U.S.  soldiers  in 
Germany  the  following  year,  and  the  2009  plot  by  Najibullah  Zazi 
to  bomb  New  York.  Well  before  the  2013  Snowden  revelations  of 
NSA  capabilities,  the  earlier  NSA  successes,  widely  reported  on  in 
the  media  at  the  time,  resulted  in  the  group  increasingly  moving 
toward  encrypted  communications.16 

In  early  2007,  al-Qa '  ida  released  an  encryption  tool  called  “Mu¬ 
jahedeen  Secrets”  (or  Asrar  al  Mujahideen)  and  then  in  January 
2008  issued  an  update  to  the  software  called  “Mujahideen  Secrets 
2.”17  It  was  used  in  2009  by  al-Qa 'ida  in  the  Arabian  Peninsula 
(AQAP)  cleric  Anwar  al-Awlaki  to  communicate  with  operatives 
in  the  West,18  and  Inspire  magazine  included  a  four-page,  step-by- 
step  tutorial  on  how  to  use  it  in  June  2010.19  A  group  of  German 
foreign  fighters  recruited  for  a  plot  to  hit  Europe  the  same  year  were 
instructed  on  how  to  use  the  software  in  the  tribal  areas  of  Pakistan 
by  al-Qa'  ida  operative  Younes  al  Mauretani.20 

While  Mujahedeen  Secrets  was  described  as  a  kind  of  custom 
encryption  tool,  it  was  just  a  friendly  wrapper  around  PGP.  Its  de¬ 
velopers  did  not  write  encryption  code  themselves;  they  used  the 
code  written  by  others.  It  was  fully  compatible  with  other  versions 
of  PGP  and  could  be  used  to  encrypt  messages  using  keys  such  as 
those  found  in  Inspire  magazine.  In  other  words,  it  was  an  end-to- 
end  encryption  tool  not  because  the  terrorists  designed  it  that  way 
but  because  they  inherited  the  code  from  cryptographers.  Creating 
original  source  code  for  encryption  that  actually  worked  would  have 
been  too  difficult,  but  they  certainly  could  make  existing  encryption 
easier  to  use.  One  lesson  policy  makers  can  learn  from  this  is  that 
the  software  code  for  encryption  is  out  there.  Attempting  to  regulate 
software  or  devices  will  not  prevent  terrorists  from  creating  their 
own  software  with  the  encryption  features  they  want. 

Al-Awlaki  placed  a  significant  emphasis  on  secure  communi¬ 
cations.  Between  2009  and  2010  he  and  Rajib  Karim,  a  British 
Airways  call  center  worker  based  in  Newcastle,  set  up  an  elaborate 
system  of  encrypted  communications  to  plot  attacks  against  British 
and  American  aviation.  The  intricate  system,  outlined  in  a  2011 
trial  in  which  Karim  was  convicted  of  terrorism  offenses,  involved 
Karim  using  end-to-end  encryption  to  send  messages  to  his  brother 
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in  Yemen,  who  was  in  contact  with  al-Awlaki. 

They  used  a  multi-layered  process  to  encrypt  the  messages. 
First,  the  text  message  was  pasted  into  an  Excel  document,  which 
used  their  own  macros  to  encrypt  the  message.  Second,  the  result 
of  that  encryption  was  copied  and  pasted  into  a  Word  document, 
then  saved  with  Microsoft’s  “password  protect”  feature,  which  is 
unbreakable  if  long  and  complex  passwords  are  chosen.  Third,  the 
Word  document  was  compressed  and  encrypted  using  the  RAR 
program,  which  is  also  unbreakable  if  long  and  complex  passwords 
are  chosen.  Lastly,  they  uploaded  to  web  hosting  sites  through  a 
URL  shortener  in  an  attempt  to  anonymize  the  metadata.1  Police 
described  his  use  of  encryption  as  “the  most  sophisticated  they  had 
seen  in  a  British  terrorist  case.”21 

When  he  was  arrested,  court  documents  show  that  he  was  calm, 
apparently  secure  in  his  knowledge  that  he  did  encryption  right.  In 
reality,  while  Western  intelligence  agencies  were  not  able,  as  far  as 
is  known,  to  intercept  any  of  his  communications  in  real  time,  he 
made  some  mistakes.22 

Karim  practiced  good  opsec  by  using  the  program  “Windows 
Washer”  and  other  Windows  tools  to  keep  his  laptop  clean  of  any 
incriminating  evidence.  He  used  full  disk  encryption  in  order  to  put 
all  of  his  plans  as  well  his  encrypted  communications  with  al-Aw- 
laki  on  an  external  hard  disk,  separate  from  his  laptop.23  He  used 
volume/container  files  for  full  disk  encryption.  He  named  the  files 
like  “Quran  DVD  Collection  l.rar,”24  where  the  “.rar”  extension  indi¬ 
cated  the  use  of  a  popular  compression  program.  However,  the  files 
were  in  fact  PGPdisk  encrypted  volumes.  Changing  the  extension 
from  “.pgd”  to  “.rar”  failed  to  fool  investigators  because,  regardless 
of  extension,  RAR  files  start  with  the  string  “Rar!”  and  PGPdisk  files 
start  with  the  string  “PGPdMAIN.”  This  is  an  example  of  the  falla¬ 
cy  of  security  through  obscurity.25  Noticing  the  ruse,  British  police 
technicians  were  able  to  decrypt  the  disk  volumes.15 

While  PGP  was  installed  on  the  computer,  Karim  does  not  ap¬ 
pear  to  have  used  it  to  encrypt  and  decrypt  messages,  perhaps  out 
of  paranoia  about  the  capabilities  of  Western  intelligence  agencies, 
but  instead  used  an  unorthodox  and  complex  technique  based  on 
cipher  codes  and  passwords  stored  on  Excel  spreadsheets.  His  big¬ 
gest  slip-up  was  that  he  had  saved  this  spreadsheet  on  his  computer, 
allowing  British  police  over  a  period  of  several  months  to  decipher 
the  messages  stored  on  his  external  hard  drive  and  use  them  as 
evidence  against  him.  The  computer  had  not  been  wiped  in  time. 
Booting  a  separate  operating  system,  such  as  the  aforementioned 
Tails,  which  the  Islamic  State  is  now  encouraging  their  operatives 
to  use,  would  have  prevented  this  mistake.26 

Encryption  in  the  Age  of  the  Islamic  State 

The  ubiquity  of  encryption  in  commercially  available  messaging 
tools  and  devices  has  made  it  increasingly  easy  for  terrorists  to  com¬ 


j  Karim’s  use  of  these  sites  may  have  helped  evade  NSA  detection.  On  the 
other  hand,  once  one  member  of  this  group  was  caught,  it  would  make 
it  even  easier  to  track  down  all  the  rest  of  the  members.  A  group  is  only 
anonymous  as  long  as  nobody  in  the  group  is  known. 

k  They  did  not  say  how  it  was  done.  In  all  likelihood,  they  used  a  brute-force 
password  cracker  that  can  attempt  a  million  passwords  per  second. 

Short  passwords,  especially  those  based  on  dictionary  words,  can  quickly 
be  cracked  this  way.  Long  passwords,  especially  complex  ones  using 
punctuation,  would  be  beyond  even  the  NSA’s  ability  to  crack,  with  all  their 
billion-dollar  supercomputers. 


municate  securely.  And  it  has  become  easier  for  terrorists  to  use  the 
tools  that  already  exist  (Telegram,  Whatsapp,  Surespot,  etc.)  rather 
than  build  their  own  software  like  Mujahedeen  Secrets.  The  main 
limiting  factor  appears  to  be  terrorist  distrust  of  some  of  these  tools 
based  on  rumors  that  they  contain  backdoors  and  a  general  para¬ 
noia  about  the  capability  of  Western  intelligence  agencies.1 

In  April  the  Islamic  State  released  a  15-page  guide  titled  “Secu- 
rite  Informatique”  in  its  French  online  magazine  Dar  al-Islam, 
demonstrating  the  importance  of  secure  communications  for  the 
group.  It  teaches  how  to  setup  Tails,  connect  to  the  Tor  network 
to  hide  one’s  location  and  Internet  address,  create  PGP  keys,  en¬ 
crypt  emails,  and  how  to  use  a  range  of  other  secure  communication 
tools.27”1 

French  police  believe  the  Paris  attackers  used  encryption  in 
some  of  their  communication,  based  on  data  collected  from  an 
abandoned  Samsung  phone  they  recovered  outside  the  Bataclan 
concert  hall  after  the  attack.  The  Telegram  app  had  been  down¬ 
loaded  onto  the  phone  seven  hours  before  the  attacks.  No  recovered 
content  from  the  messaging  app  is  mentioned  in  the  French  police 
documents,  suggesting  the  technology  allowed  them  to  cover  their 
tracks  successfully  and  possibly  by  using  the  self-destruct  feature 
within  Telegram.  Paris  prosecutor  Francois  Mollins  stated  after  the 
attacks  that  French  investigators  often  encountered  Telegram  in 
their  investigations  and  cannot  penetrate  its  encryption.28 

In  August  2015,  French  authorities  arrested  and  interrogated 
Reda  Hame,  a  French  Islamic  State  recruit  who  had  gone  to  Syria 
where,  over  a  period  of  several  weeks  in  June  2015,  he  received  ru¬ 
dimentary  training  in  Raqqa  and  was  tasked  by  Paris  attack  team 
leader  Abdelhamid  Abaaoud  with  returning  to  France  to  commit  a 
terrorist  attack.  Hame  was  instructed  in  a  rather  bizarre  technique 
to  use  a  TrueCrypt  volume  file  in  which  full  disk  encryption  was 
used  as  a  replacement  for  end-to-end  encryption.  The  system  in¬ 
volved  creating  text  files  with  messages  inside  the  virtual  disk  drive, 
then  uploading  the  container  file  to  file-sharing  websites.29 

On  one  hand,  this  technique  provided  good  opsec.  The  normal 
method  using  PGP  to  encrypt  a  file  means  an  unencrypted  copy 
could  still  be  left  on  the  disk  drive  accidentally.  By  creating  a  file  in 
a  virtual  disk  drive,  no  other  copy  would  exist  on  the  system.  But  on 
the  other  hand,  this  technique  is  another  example  of  the  fallacy  of 
security  through  obscurity.  As  with  Rajib  Karim,  the  obvious  intent 
was  to  avoid  NSA  collection  of  email  metadata  by  using  an  obscure 
method  of  uploading  to  file-sharing  sites.  However,  this  remains 
obscure  only  temporarily.  Once  Hame  was  caught  and  interrogated, 
his  technique  would  have  been  conspicuous,  making  it  easier  for  the 
NSA  and  its  European  counterparts  to  track  the  metadata  of  others 
using  this  technique. 


I  For  example,  the  Islamic  State  has  instructed  its  followers  not  to  trust  Tor. 
“As  to  the  question  of  whether  the  NSA  can  crack  their  code,  the  answer 
is  probably  yes.  That’s  why  you  should  never  send  anything  personal  or 
sensitive  or  that  you  do  not  want  to  be  intercepted  over  Tor."  Dar  al-Islam 
issue  9,  p.  38. 

m  An  English  Islamic  State  deep  web  forum  user  posted  the  same  month 
also  extolled  the  virtues  of  PGP  encryption.  “This  method  of  encryption  is 
the  same  one  used  by  the  assassins,  drug  dealers,  and  smugglers  on  the 
hidden  internet,  and  this  is  due  to  its  high  level  of  security,  such  that  one 
cannot  even  respond  to  a  post  or  message  without  having  the  cypher," 
the  user  stated.  See  “Member  of  Top  ISIS  Deep  Web  Forum  Releases  First 
Lesson  in  Encryption  Course."  Flashpoint  Intelligence,  April  15,  2015. 
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It  appears  that  Hame  never  actually  used  the  technique,  how¬ 
ever.  According  a  transcript  of  his  interrogation  he  forgot  the  pass¬ 
words  and  names  of  the  websites  he  was  supposed  to  use.  Instead, 
as  it  appears  in  most  cases,  most  of  the  planning  of  his  terrorist  ac¬ 
tivities  was  by  face-to-face  contact,  not  electronic  communication.30 

Other  Islamic  State  operatives  resorted  to  a  much  more  straight¬ 
forward  use  of  encryption.  Junaid  Hussain,  a  British  Islamic  State 
operative  who  had  been  involved  in  hacking  before  departing  for 
Syria  and  was  killed  in  a  drone  strike  in  August  2015, 31  was  a  pro¬ 
lific  user  of  the  encryption  messaging  app  Surespot,  using  it  to 
provide  Islamic  State  sympathizers  in  the  United  Kingdom  with 
bomb-making  tips  and  encouraging  them  to  carry  out  attacks.32  For 
example,  he  used  it  to  discuss  targeting  options  with  Junead  Khan, 
a  British  extremist  who  was  convicted  of  a  plot  to  attack  U.S.  Air 
Force  personnel  in  England  that  was  thwarted  in  July  2015.  In  or¬ 
der  to  retrieve  information  from  Khan’s  iPhone,  British  undercover 
offices  employed  an  elaborate  ruse  to  trick  Khan  into  handing  over 
his  iPhone  just  before  they  arrested  him  so  that  they  could  change 
its  password  settings  before  it  locked.33 

Hussain  also  communicated  using  encryption  with  one  of  the 
American  Islamic  State  followers  who  opened  fire  outside  a  “Draw 
the  Prophet  Mohammed”  contest  in  Garland,  Texas,  in  May  2015. 
The  morning  of  the  attack  109  encrypted  messages  were  exchanged 
between  Hussain  and  the  gunman  that  were  impossible  for  the  FBI 
to  read.34 

According  to  reports,  in  the  drone  strike  that  killed  Junaid  Hus¬ 
sain  (and  fellow  militant  Reyaad  Khan),  British  agents  were  able 
to  find  their  physical  location  by  “hacking”  their  end-to-end  en¬ 
crypted  app  Surespot.35  Precise  details  are  scarce,  but  it  is  unlikely 
that  Surespot  itself  was  hacked  but  merely  used  in  the  hack.  Once 
British  agents  discovered  their  target’s  address  (an  opportunity  may 
have  been  from  Hussain  posting  it  online  or  the  phone  acquired 
from  Junead  Khan,  described  earlier),  they  could  send  a  phishing 
message  with  a  link.  This  link  could  be  as  simple  as  a  recording  of 
their  current  internet  address  or  as  complex  as  a  virus. 

With  an  internet  address,  intelligence  services  could  discover  the 
unique  identifier  of  the  phone  (known  as  the  IMSI  or  International 
Mobile  Subscriber  Identifier).  This  would  require  intelligence  ser¬ 
vices  to  hack  into  the  phone  company  servicing  the  Islamic  State 
or  to  utilize  a  paid  informant  on  the  inside.  Then  IMSI  catchers  in 
drones/airplanes  flying  overhead  can  be  used  to  pinpoint  the  radio 
signals  coming  from  the  phone. 

With  a  virus,  they  can  do  all  that  and  more.  Instead  of  grabbing 
the  IMSI  from  the  phone  company,  the  virus  can  simply  acquire  it 
from  the  phone.  Instead  of  planes  flying  overhead,  the  phone  itself 
can  report  its  GPS  location  on  a  regular  basis  via  the  internet.  Intel¬ 
ligence  services  like  the  GCHQ  and  NSA  have  such  viruses  in  their 
arsenal,  known  as  implants,  which  use  what  is  known  as  “Odayn 
exploits”  to  break  into  the  phone  as  soon  as  a  user  taps  on  a  link 
within  the  Surespot  app. 

Odays  are  the  archetypal  cyber  weapon.  Intelligence  services  can 
point  them  at  a  target,  gain  control  of  the  computer,  and  implant 


n  An  Oday  is  a  software  bug  that  can  be  used  to  break  into  a  computer  that 
no  one,  even  the  software  maker,  knows  exists.  The  fact  that  intelligence 
services  buy  Odays  from  hackers  but  do  not  tell  the  manufacturers  is 
controversial  among  those  working  in  the  tech  field. 


a  virus  that  allows  them  to  maintain  control.”  This  technique  gets 
away  from  remote  signals  detection  to  find  a  target,  which  was  the 
traditional  role  of  the  NSA,  and  moves  toward  subverting  the  device 
to  monitor  itself. 

Islamic  State-inspired  terrorists  have  recently  demonstrated 
good  opsec.  The  San  Bernardino  terrorists  used  unencrypted  burn¬ 
er  phones36  on  the  day  of  the  attack,  then  destroyed  them  so  that 
evidence  could  not  be  recovered.  They  also  possessed  an  iPhone, 
provided  by  their  employer,  which  the  FBI  could  not  crack  due  to 
Apple’s  powerful  full  device  encryption.  After  four  months  of  failing 
to  gain  access,  the  FBI  reportedly  paid  close  to  $1  million  to  a  hack¬ 
er  to  find  and  exploit  a  vulnerability  in  Apple’s  software  that  allowed 
them  to  crack  the  password  and  access  the  phone.37  p 

To  do  this,  the  FBI  likely  bought  an  Oday,q  which  would  have 
worked  not  by  immediately  hacking  the  phone  but  by  allowing 
those  trying  to  break  into  the  phone  to  guess  passcodes  quickly, 
without  the  normal  delay  that  iPhone  uses  to  defeat  brute-force 
cracking/ 

Conclusion 

The  encryption  used  today  was  not  developed  by  intelligence  agen¬ 
cies  or  militaries  but  by  university  students  and  corporations.  Even 
militaries,  however,  use  this  encryption  because  encryption  they 
would  develop  themselves  just  is  not  good  enough.  And  it  is  clear 
from  a  survey  of  jihadist  publications  that  all  encryption  techniques 


o  They  are  extremely  difficult  to  find.  Intelligence  services  pay  hackers  in  the 
controversial  Oday  market  to  find  bugs  and  report  them  to  the  intelligence 
agencies.  Every  time  that  Microsoft  updates  Windows  or  Apple  updates 
the  iPhone,  the  Odays  often  break,  requiring  the  intelligence  agencies  to  go 
back  to  the  hackers  for  replacements. 

p  After  the  San  Bernardino  iPhone  was  opened  by  a  third  party,  Apple 
moved  to  tighten  its  full  device  encryption,  recently  hiring  John  Callas, 
a  well-known  encryption  expert  who  helped  develop  both  PGP  and  the 
Blackphone,  to  work  on  the  problem  in  the  belief  that  anything  that 
weakens  security  for  law  enforcement  ("backdoors")  inevitably  makes  a 
phone  insecure  against  all  other  threats.  Russel  Brandom,  “Encryption 
expert  returns  to  Apple  in  wake  of  San  Bernardino  standoff,”  The  Verge,  May 
26,  2016. 

q  The  iPhone  uses  full-device  encryption  with  a  hardware  key  that  has  been 
entangled  with  the  passcode.  Consequently,  the  only  possible  way  to 
decrypt  the  iPhone  is  with  that  entangled  key.  One  way  to  obtain  it  is  by 
using  acid  to  remove  layers  from  the  chip  and  read  that  hardware  key,  but 
this  method  carries  a  high  chance  of  destroying  the  key  before  it's  read. 

The  only  other  way  is  to  make  frequent  guesses  of  the  passcode,  and  that 
can  only  work  by  using  an  Oday  that  bypasses  Apple's  software  designed 
to  prevent  guesses.  In  other  words,  by  design,  the  only  two  possible  ways 
to  decrypt  an  iPhone  is  either  by  attacking  the  hardware  or  brute-force 
guessing  of  the  passcode  using  an  Oday  to  disable  the  anti-guessing 
software. 

r  Normally,  bad  guesses  cause  the  phone  to  wait  longer  and  longer  between 
guesses,  and  after  10  bad  guesses,  the  phone  is  wiped.  The  Oday  exploit  the 
FBI  likely  purchased  prevented  both  the  long  wait  and  the  wipe  so  that  an 
infinite  number  of  guesses  could  be  made  as  quickly  as  the  phone  would 
allow  (roughly  12  guesses  per  second).  Reports  are  conflicting,  however.  It 
may  be  that  the  FBI  purchased  the  Oday  technique  so  that  they  could  use  it 
on  similar  phones,  or  it  may  be  that  the  hacker  used  the  Oday  and  cracked 
the  password  for  the  FBI  but  did  not  give  them  the  Oday.  See,  for  example, 
“Ellen  Nakashima,  FBI  paid  professional  hackers  one-time  fee  to  crack  San 
Bernardino  iPhone,”  Washington  Post,  April  12, 2016. 
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are  known  to  terrorists. 

Software  must  be  written  to  perform  encryption.  This,  too,  is  out 
in  the  world.  The  source-code  for  virtually  all  encryption  is  available 
to  anyone  who  can  write  software.  Indeed,  paradoxically,  the  most 
trusted  encryption  software  is  also  the  software  whose  source-code 
is  public,  allowing  anybody  to  read  it  and  find  flaws  before  the  NSA 
or  GCHQ.  can.  That  is  why  PGP  appears  so  prominently  among 
non-state  actors  seeking  to  communicate  securely.  They  can  read 
the  code  and  verify  for  themselves  whether  an  intelligence  agency 
has  inserted  a  backdoor. 

The  FBI  has  called  for  laws  mandating  encryption  backdoors, 
but  these  laws  would  be  mostly  futile.  They  do  not  apply  to  soft¬ 
ware  or  phones  created  in  other  countries,  for  example.  They  do 
not  apply  to  jihadist  programmers  who  create  their  own  apps  based 
on  open-source  software.  This  is  why  many  in  the  intelligence  com¬ 
munity,  such  as  former  head  of  the  NSA  Michael  Hayden,  oppose 
backdoors.38 

So  what  are  the  options?  Security  agencies  will  need  to  out¬ 
smart  the  software.  In  end-to-end  encryption,  it  is  no  longer  viable 
to  crack  the  encryption  in  the  middle.  Intelligence  agencies  must 
instead  hack  the  software  on  the  ends.  Oday  exploits  will  likely  be 


the  most  common  way  the  NSA  will  eavesdrop  on  communications 
in  the  future  -  by  hacking  the  “ends”  of  end-to-end  communication 
with  an  Oday. 

Security  services  will  also  have  to  exploit  poor  opsec  by  terror¬ 
ists.  From  the  perspective  of  security  services  the  most  worrying 
software  is  not  one  with  the  best  encryption  but  one  that  allows 
fewer  user  mistakes.  The  opsec  feature  of  self-destructing  messag¬ 
es,  for  example,  is  probably  one  of  the  most  frustrating  features  for 
intelligence  services. 

In  other  words,  instead  of  a  team  of  code  breakers,  the  future 
will  see  more  and  more  teams  of  people  dedicated  to  breaking 
into  software  and  outwitting  users.  The  NSA’s  vast  compute  power 
will  not  be  dedicated  to  complex  encryption  algorithms  but  to  the 
rather  simple  task  of  guessing  that  a  terrorist’s  password  is  “Pass- 
wordl234.” 

Thus,  while  encryption  is  itself  nearly  perfect,  the  world  is  not 
about  to  enter  an  era  of  terrorists  communicating  with  impunity. 
While  end-to-end  encryption  means  security  agencies  have  little 
hope  of  cracking  the  middle,  they  will  still  have  easy  ways  to  attack 
the  ends,  either  by  hacking  the  software  or  outwitting  the  user.  CTC 
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The  Road  to  Orlando:  Jihadist-inspired 
Violence  in  the  West,  2012-2016 

By  Sam  Mullins 


This  analysis  of  47  cases  of  jihadist-inspired  violence  car¬ 
ried  out  in  Western  countries  between  January  1, 2012, 
and  the  June  12, 2016,  Orlando  attack  sheds  light  on  the 
evolving  terrorist  threat.  The  data  shows  that  the  Syrian 
civil  war  and  the  rise  of  the  Islamic  State  have  coincided 
with  an  increase  in  the  number  of  attacks,  with  more 
than  half  of  all  violent  incidents  taking  place  in  France 
and  the  United  States.  Notwithstanding  the  recent  at¬ 
tacks  in  Paris  and  Brussels,  most  attacks  were  carried 
out  by  individuals  with  no  direct  ties  to  overseas  terror¬ 
ist  groups  and  were  low-tech  and  relatively  ineffectual. 
Half  of  all  attackers  had  a  criminal  past,  and  perhaps  as 
many  were  unemployed.  A  majority  of  attacks  targeted 
civilians,  although  violence  was  also  frequently  directed 
against  members  of  law  enforcement  or  the  military. 
Knife  attacks  were  the  most  common  while  shootings 
were  the  deadliest. 


Shortly  after  2:00  AM  on  the  morning  of  June  12,  2016, 
Omar  Mateen,  an  American  citizen  of  Afghan  descent, 
stormed  into  a  gay  nightclub  in  Orlando,  Florida,  and 
opened  fire  with  an  assault  rifle  and  semiautomatic  hand¬ 
gun,  killing  49  people.  Although  many  questions  remain, 
Mateen  pledged  allegiance  to  the  Islamic  State  in  a  911  call  made 
during  the  attack.  This  would  make  it  the  deadliest  terrorist  attack 
in  the  United  States  since  9/11  in  addition  to  the  deadliest  mass 
shooting  regardless  of  motivation.  It  thus  appears  to  be  the  latest 
in  a  steadily  growing  number  of  jihadist-inspired  violent  incidents 
in  Western  countries.  Some  of  these  incidents,  most  notably  the 
deadly,  coordinated  assault  in  Paris  last  November  and  the  bomb¬ 
ing  in  Brussels  four  months  later,  are  clearly  directed  and  funded 
by  foreign  terrorist  organizations  (FTOs).  Others  are  carried  out 
independently  by  autonomous  groups  and  individuals  who  are  of¬ 
ten  lacking  substantial  overseas  connections  but  nevertheless  share 
the  same  murderous  ideology,  while  others  still  are  conducted  by 
troubled  individuals  who  seem  to  be  driven  at  least  as  much  by 
mental  illness  as  by  exposure  to  jihadi  propaganda1  or  related  media 
coverage. 

Precisely  where  Mateen  falls  on  this  spectrum  has  yet  to  be  es¬ 
tablished.  The  manifestation  of  jihadist-inspired  violence  in  the 
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West  is  clearly  extremely  diverse.  It  also  appears  to  have  increased 
substantially  since  the  outbreak  of  war  in  Syria  and  the  rise  of  the 
Islamic  State.  However,  in  order  to  gain  a  deeper  understanding 
of  the  nature  of  the  threat,  it  is  important  to  examine  the  use  of 
violence  more  thoroughly.  This  article  analyzes  all  jihadist-inspired 
violent  attacks  executed  in  Western  Europe,  North  America,  and 
Australia  from  2012  to  the  June  12  Orlando  attack  (i.e.  since  the 
escalation  of  conflict  in  Syria  and  Iraq).  The  analysis  begins  with 
a  statistical  assessment  of  the  frequency  and  location  of  attacks, 
characteristics  of  perpetrators— including  their  links  to  foreign  ter¬ 
rorist  organizations  (FTOs)— and  modus  operandi,  followed  by  an 
examination  of  what  the  data  reveals  about  the  threat  trajectory  in 
the  West. 

Frequency  of  Attacks 

From  January  2012  to  June  12,  2016,  there  have  been  47  violent 
attacks  in  Western  countries  that  were  at  least  partially  inspired  by 
Islamist  political  concerns  and/or  violent  jihadist  propaganda  and 
ideas,  as  promoted  by  al-Qa'  ida  and  the  Islamic  State  and  widely 
covered  in  the  media.’1  This  compares  to  just  26  attacks  during  the 
entire  preceding  11-year  period,  representing  a  significant  increase 
in  frequency.  Moreover,  the  number  of  attacks  has  increased  each 
year,  with  three  in  2012,  five  in  2013, 11  in  2014, 16  in  2015,  and  12 
so  far  in  2016  (compared  to  five  this  time  last  year),  which  suggests 
a  continuing  upward  trend  in  the  coming  months  (see  Figure  1). 

Of  the  total  47  jihadist-inspired  attacks  since  2012, 11  (24  per¬ 
cent)  were  classified  as  “borderline,”  meaning  the  jihadist  compo¬ 
nent  was  present  to  varying  extents  but  was  far  from  clear,  was  often 
downplayed  by  the  authorities,  and  was  frequently  overshadowed 
by  mental  health  issues  or  bizarre  circumstances.  Examples  include 
the  beheading  of  a  woman  in  Oklahoma  in  September  2014, 2  an  ap¬ 
parently  Islamic  State-inspired  murder  in  Denmark  the  following 
month,3  the  Lindt  cafe  siege  in  Sydney  in  December  of  the  same 
year,4  and  a  fatal  stabbing  at  Grafing  train  station,  just  outside  of 
Munich,  in  May  2016.5  Arguably,  such  borderline  cases  should  be 
excluded  from  the  analysis;  however,  by  including  them— without 
necessarily  labeling  them  acts  of  terrorism — one  can  gain  a  more 
complete  understanding  of  the  ways  in  which  jihadist  ideas  are  cur¬ 
rently  shaping,  if  not  driving  the  expression  of  violence  in  contem¬ 
porary  Western  society. 


a  This  data  was  collected  using  open  sources.  Note  that  in  five  cases,  two 
or  three  acts  of  violence  were  separated  by  at  least  a  day,  giving  a  total 
of  54  actual  attacks.  These  include  the  attacks  by  Mohamed  Merah,  the 
Tsarnaevs,  Ali  Muhammad  Brown,  the  Kouachis,  and  Amedy  Coulibaly.  In 
addition,  some  attacks  (such  as  in  Paris  and  Brussels)  involved  multiple 
acts  of  violence  within  a  short  space  of  time.  These  are  all  counted  as  single 
cases  for  the  purposes  of  this  analysis.  See  appendix  for  full  list  of  cases. 
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Figure  1:  Frequency  ofjihadist-inspired  violent  attacks  in  the  West: 
January  1,  2012-June  12,  2016 


Location  of  Attacks 

Since  2012  just  eight  Western  countries  have  suffered  attacks  (see 
Figure  2).  In  rank  order,  these  are  France  (17),  the  United  States 
(10),  Germany  (five),  Denmark  and  Australia  (four  each),  Canada 
(three),  and  the  United  Kingdom  and  Belgium  (two  each).  While 
attacks  elsewhere  in  the  West  are  certainly  possible,  if  not  proba¬ 
ble,  more  than  50  percent  of  attacks  so  far  have  occurred  in  either 
France  or  the  United  States,  suggesting  that  these  two  countries 
are  particularly  likely  to  experience  jihadist-inspired  violence  in  the 
near  future. 


Perpetrators 

When  examining  who  has  been  responsible  for  jihadist-inspired 
acts  of  violence  in  Western  countries,  it  is  immediately  obvious  that 
the  overwhelming  majority  has  been  young  males.  There  were  67 
male  offenders  in  total,  with  an  average  age  of  25.9  (n=59),  com¬ 
pared  to  just  three  females,  with  an  average  age  of  19. 7b  At  least 
23  percent  of  attackers  (and  perhaps  50  percent  or  more)  were 
unemployed  at  the  time  they  committed  their  offense(s);  at  least 
50  percent  had  criminal  records  (all  males);  at  least  20  percent 
of  individuals  were  Islamic  converts;  and  at  least  14  percent  had  a 
documented  history  of  psychological  problems11  (again,  all  males). 

Although  only  one  of  the  females  committed  an  offense  by  her¬ 
self,11  the  vast  majority  (70  percent)  of  all  attackers  acted  alone, 
while  another  19  percent  acted  in  pairs,  regardless  of  any  extremist 
or  terrorist  affiliations.  Just  seven  cases  (15  percent)  are  presently 
confirmed  to  have  had  established  links  to  FTOs,  namely  Mohamed 
Merah,  Mehdi  Nemmouche,  and  the  Kouachi  brothers  (all  linked 
to  al-Qa'ida),  and  Ayoub  el-Khazzani,  the  Paris  and  Brussels  at¬ 
tackers,  and  Safia  S.  (each  linked  to  the  Islamic  State).  At  least  an¬ 
other  two  cases  involved  online  communication  with  Islamic  State 


members  abroad; e  however,  for  the  most  part  the  perpetrators  of 
jihadist-inspired  violence  in  the  West  have  been  lacking  direct  or¬ 
ganizational  connections  or  support.  Notably,  the  average  number 
of  fatalities  for  FTO-linked  attacks  was  26.4,  compared  to  just  one 
for  autonomous  groups  and  lone  actors/ 

Modus  Operandi 

In  terms  of  targeting,  civilians  have  borne  the  brunt  ofjihadist-in¬ 
spired  violence  in  the  West,  much  as  they  do  elsewhere,  having 
been  targeted  in  28  of  the  47  cases  included  in  this  analysis  (i.e. 
60  percent;  see  Figure  3).  Moreover,  seven  attacks  against  civilians 
were  directed  specifically  against  Jews  and  six  of  these  took  place  in 
France,  suggesting  that  anti-Semitism  is  particularly  strong  among 
French  jihadis.  Police  were  attacked  in  16  cases  (34  percent),  al¬ 
though  there  were  not  always  the  primary  target,  while  military 
personnel  were  attacked  in  10  (21  percent).  Different  target-types 
were  present  in  just  seven  cases  (15  percent). 

As  shown  in  Figure  4,  21  cases  (45  percent)  have  involved  the 
use  of  edged  weapons  (knives  and  in  one  instance  an  ax),  making 
them  the  weapon  of  choice  among  violent  jihadists  and  their  im¬ 
itators  in  Western  countries.  A  further  18  cases  (38  percent)  have 
involved  the  use  of  firearms,  and  these  have  accounted  for  the  vast 
majority  of  casualties.  Meanwhile,  improvised  explosive  devices 
(IEDs)  were  used  in  just  seven  cases,  resulting  in  fatalities  in  just 
three  (Boston  in  2013,  Paris  in  2015,  and  Brussels  in  2016).  Other 
forms  of  “weaponry”  have  included  motor  vehicles  (used  in  four 
cases),  bare  hands  (used  twice6),  and  boiling  water  (used  just  once, 
in  combination  with  a  razor  blade7).  In  six  cases,  not  mutually  ex¬ 
clusive  of  those  mentioned  above,  multiple  types  of  weapons  were 
used  in  combination. 

What  the  Data  Shows 

Although  it  is  important  to  bear  in  mind  that  the  analysis  here  does 
not  take  the  wider  universe  of  prevented  plots  into  consideration,  it 
nevertheless  provides  important  insights  into  the  attacks  that  are 
most  likely  to  take  place.  The  fact  that  jihadist-inspired  violence  has 
increased  substantially  since  2012  demonstrates  that  the  radical¬ 
izing  influence  of  the  conflict  in  Syria  and  Iraq,  and  of  the  Islamic 
State  in  particular,  has  not  been  limited  to  the  mobilization  of  for¬ 
eign  fighters.  However,  it  is  important  to  note  that  the  distribution 
of  executed  attacks  does  not  appear  to  be  proportionate  to  the  scale 
of  mobilization  of  foreign  fighters  in  each  country. 

For  instance,  according  to  official  estimates  compiled  by  the  Sou- 
fan  Group,  the  United  Kingdom  ranks  second  in  the  mobilization  of 
foreign  fighters  from  Western  countries,  surpassed  only  by  France, 
and  yet  has  experienced  the  lowest  number  of  attacks.8  Similar¬ 
ly,  countries  such  as  Sweden  and  Austria  (jointly  ranked  fourth  in 


b  This  includes  only  confirmed,  direct  perpetrators  of  violence  and  therefore 
excludes  any  wider  support  networks. 

c  The  possibility  of  mental  health  issues  was  raised  in  another  7  percent  of 
male  offenders  in  the  sample. 

d  Safia  S.  stabbed  a  German  police  officer  in  the  neck  in  Hannover  in  an 
attempted  “martyrdom  operation."  “German  Prosecutors:  Teen  who 
Stabbed  Cop  'Supported  IS,”'  Deutsche  Welle,  April  15,  2016. 


e  These  include  the  Garland,  Texas,  attackers  of  May  2015  and  Yassin  Salhi, 
who  beheaded  his  boss  in  France  the  following  month.  Fran  Blandy,  “French 
Prosecutor  Confirms  ‘Terror  Motive',  IS  Link  to  Beheading,"  Yahoo  News, 
June  30,  2015;  Rukmini  Callimachi,  “Clues  on  Twitter  Show  Ties  Between 
Texas  Gunman  and  ISIS  Network,"  New  York  Times,  May  11,  2015. 

f  This  calculation  excludes  the  Orlando  attack,  given  that  information 

regarding  possible  links  to  FTOs  has  yet  to  be  confirmed.  If  indeed  Mateen 
received  support  from  the  Islamic  State  (or  any  other  FTO),  this  would  raise 
the  average  number  of  fatalities  in  FTO-linked  cases  to  29.3.  If  it  transpires 
that  Mateen  acted  autonomously,  this  would  raise  the  average  number  of 
people  killed  in  these  cases  to  2.4. 
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Figure  2:  Location  ofjihadist-inspired  violence  in  the  West:  Janu¬ 
ary  1,  2012-June  12,  2016 

number  of  foreign  fighters)  have  not  experienced  jihadist-inspired 
violence  after  2012.E  Of  course,  given  the  degree  of  radicalization 
and  foreign  fighter  flows,  we  might  expect  France  to  rate  highly  in 
terms  of  domestic  attacks;  however,  to  see  the  United  States,  which 
has  produced  a  relatively  small  number  of  foreign  fighters,  in  sec¬ 
ond  place  is  rather  more  unexpected. 

The  causes  of  this  variation  are  likely  complex.  France  and  the 
United  States  are  both  high-priority  targets  for  violent  jihadis  for  a 
variety  of  reasons,  not  least  of  which  is  their  lead  roles  in  the  fight 
against  the  Islamic  State,  which  raises  the  likelihood  of  attacks.  The 
relatively  high  number  of  incidents  in  the  United  States  may  also 
be  explained  in  part  by  the  availability  of  firearms  in  combination 
with  a  relative  lack  of  domestic  facilitation  networks  in  the  country 
and  the  difficulty  in  reaching  Syria  and  Iraq,  leading  to  radicalized 
individuals  launching  attacks  at  home  instead.  Simply  put,  fewer 
opportunities  to  travel  overseas  to  fight  may  result  in  greater  in¬ 
centive  to  act  at  home.  This  becomes  especially  relevant  in  light  of 
the  recent  reduction  in  the  rate  of  mobilization  of  foreign  fighters, 
including  a  significant  drop-off  in  the  United  States.9  Of  course, 
the  relative  capability  and  resources  of  domestic  security  services 
also  come  into  play,  and  yet  it  is  impossible  to  prevent  every  attack, 
especially  when  faced  with  the  threat  of  seemingly  spontaneous  acts 
of  violence  by  lone  extremists. 

When  it  comes  to  the  perpetrators  ofjihadist-inspired  violence, 
it  is  quite  remarkable  to  find  such  high  rates  of  criminality,  unem¬ 
ployment,  and  mental  health  problems  in  addition  to  such  a  high 
percentage  of  Islamic  converts.  Recent  descriptions  of  Australian 
and  European  foreign  fighters  in  particular  have  tended  to  empha¬ 
size  socioeconomic  marginalization.10  However,  the  percentages 
here  are  still  surprisingly  high  when  compared  to  earlier  studies 
based  on  larger  samples.11  There  are  at  least  two  possible  dynam¬ 
ics  at  play  that  are  worthy  of  further  exploration.  One  is  that  the 
socioeconomic  status  of  Western  jihadis  in  general  has  declined  in 
recent  years.  This  would  be  consistent  with  generational  trends  de¬ 
scribed  by  Marc  Sageman12  as  well  as  current  intelligence  and  law 


g  In  June  2015  a  man  of  Bosnian  origin  drove  a  car  into  pedestrians  before 
exiting  the  vehicle  and  attacking  people  with  a  knife  in  the  Austrian  city 
of  Graz.  However,  authorities  were  quick  to  discount  the  possibility  of 
terrorism  and  have  not  released  any  information  that  would  indicate 
jihadist  motivation.  See  “Police  Reconstruct  Events  of  Graz  Tragedy,"  The 
Local,  June  23, 2015. 


enforcement  assessments.  For  example,  in  the  United  Kingdom, 
recent  research  by  police  and  intelligence  analysts  revealed  that  “ap¬ 
proximately  40  percent  of  the  several  thousand  Islamist  extremists 
across  the  country  were  committing  low-level  criminality  with  of¬ 
fenses  that  included  benefit  fraud,  disqualified  driving,  and  even 
drug  crimes.”13  Indeed,  as  the  director  of  Europol,  Rob  Wainwright, 
recently  remarked,  “the  link  between  terrorism  and  crime  is  much 
more  prevalent  now  than  at  any  other  time  in  the  past.”14 

The  other  possibility  is  that  there  is  a  qualitative  difference  be¬ 
tween  the  average  Western  jihadi  and  those  who  actually  conduct 
domestic  acts  of  violence.  To  some  extent,  this  is  a  reflection  of 
sampling  bias.  By  focusing  only  on  those  attacks  that  were  actually 
executed,  there  is  a  disproportionate  number  of  lone  actors  (since 
they  are  harder  to  detect  in  advance)  who  are  especially  likely  to  be 
suffering  from  psychological  problems.15  Similarly,  the  inclusion  of 
“borderline”  cases  ofjihadist-inspired  violence,  which  have  become 
more  common  in  recent  years, h  accounts  for  six  out  of  10  individ¬ 
uals  with  a  documented  history  of  mental  health  issues.  It  is  also 
possible  that  the  high  rates  of  criminality  in  the  current  sample  are 
reflective  of  greater  skill  and  experience  among  criminals  at  evading 
the  attention  of  law  enforcement.  Still,  the  perpetrators  ofjihad¬ 
ist-inspired  attacks  are  still  frequently  disadvantaged  compared 
to  society  as  a  whole.  The  apparent  exception  to  this  is  females, 
who— although  there  were  only  three — did  not  have  histories  of 
criminality  or  mental  disorder.  The  data  here  is  thus  suggestive  of 
a  mismatch  between  male  and  female  jihadist  offenders,  the  latter 
being  younger  and  less  obviously  marginalized.  Whether  or  not  this 
holds  true  for  Western  jihadis  in  general  and  whether  it  is  indica¬ 
tive  of  different  motivations  and/or  processes  of  radicalization  will 
require  further  research. 

With  respect  to  modus  operandi,  the  observed  preference  for  at¬ 
tacking  civilians  or  unsuspecting  uniformed  personnel  using  knives 
or  firearms  is  again  partially  related  to  the  predominance  of  lone 
actors  and  the  inclusion  of  borderline  cases,  both  of  whom  are  gen¬ 
erally  lacking  in  capability  and  are  therefore  more  likely  to  attack 
soft  targets  using  readily  available  weapons.  What  is  significant, 
however,  is  how  these  variables  have  changed  over  time.  Compared 
to  the  26  incidents  ofjihadist-inspired  violence  in  Western  coun- 
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Figure  3:  Targets  ofjihadist-inspired  violence  in  the  West:  January 
1,  2012-June  12,  2016 


h  Only  three  of  26  jihadist-inspired  violent  attacks  from  2001-2011  were 
“borderline”  cases. 
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tries  from  2001-2011,  there  is  now  clearly  a  stronger  preference 
toward  targeting  police  and  using  weapons  other  than  explosives.' 
The  former  trend  may  be  due  to  a  combination  of  contagion  (i.e. 
copycat  attacks)  and  the  fact  that  police  are  likely  to  come  into 
contact  with  criminals  and  people  suffering  from  mental  health 
problems,  who  together  account  for  a  significant  portion  of  violent 
jihadist  attackers. 

As  already  noted,  the  latter  trend  (i.e.  away  from  explosives)  is 
related  to  the  skills  and  capabilities  of  lone  actors,  but  it  is  also  a 
reflection  of  the  willingness  of  FTOs  to  encourage  and  to  sponsor 
directly  more  rudimentary  forms  of  attack  rather  than  accepting 
greater  risk  of  detection  in  the  hope  of  pulling  off  something  more 
spectacular.  Indeed,  Islamic  State  spokesman  Abu  Muhammad 
al-Adnani  spelled  this  out  in  excruciating  detail  in  September  2014 
when  he  declared  to  his  followers  that  “if  you  are  not  able  to  find  an 
IED  or  a  bullet,  then  single  out  the  disbelieving  American,  French¬ 
man,  or  any  of  their  allies.  Smash  his  head  with  a  rock,  or  slaughter 
him  with  a  knife,  or  run  him  over  with  your  car,  or  throw  him  down 
from  a  high  place,  or  choke  him,  or  poison  him.”16  These  sentiments 
clearly  resonate  with  a  significant  number  of  likeminded  people  and 
are  continually  echoed  throughout  jihadist  circles.  As  one  individu¬ 
al  recently  commented  on  the  dark-web  forum  Shumukh  al-Islam, 
“A  simple  operation  killing  two  or  three  disbelievers  and  getting 
martyred  in  it...  is  better  than  a  failed  operation  that  didn’t  even 
happen  because  you  were  captured.”17  Of  course,  the  Islamic  State’s 
commitment  to  attacking  the  West,  combined  with  the  return  of 
significant  numbers  of  foreign  fighters— some  of  whom,  like  Brus¬ 
sels  attacker  Najim  Lachraaoui,  will  have  undoubtedly  trained  in 
explosives— suggests  that  we  may  yet  witness  a  resurgence  in  the 
successful  use  of  IEDs.  Then  again,  this  does  not  negate  the  in¬ 
creased  chances  of  detection  nor  the  fact  that  it  is  lone  actors  and 
small,  independent  groups  that  are  consistently  responsible  for  the 
majority  of  jihadist-inspired  violence  in  the  West.  Whether  or  not 
he  received  any  external  support,  Mateen’s  actions  are  a  reminder 
that  individual  attackers  can  achieve  mass  casualties.  The  majority, 
however,  do  not. 


i  More  specifically,  the  percentage  of  civilian  targets  attacked  from  2001 
to  2011  was  77  percent,  which  afterward  reduced  to  60  percent.  Police 
targets  increased  from  4  percent  to  34  percent,  while  military  targets 
remained  fairly  constant  at  19  percent  and  21  percent,  respectively.  As  for 
weaponry,  use  of  explosives  decreased  dramatically  from  50  percent  to 
just  15  percent;  firearms  increased  from  23  percent  to  38  percent;  edged 
weapons  increased  from  19  percent  to  45  percent;  and  cars  increased  from 
4  percent  to  9  percent. 
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Figure  4:  Weapons  used  in  jihadist-inspired  violent  attacks  in  the 
West:  January  1, 2012-June  12, 2016  (*. Miscellaneous  refers  to  bare 
hands/boiling  water. ) 


Conclusion 

Amidst  the  current  climate  of  fear  and  uncertainty  largely  centered 
around  the  Islamic  State,  there  is  a  need  for  objective,  empirically 
grounded  analysis  of  jihadist-inspired  violence.  Although  there  is 
little  doubt  that  the  threat  to  the  West  has  never  before  been  great¬ 
er,  this  reveals  relatively  little  about  what  to  expect.  By  examining 
the  occurrence  of  jihadist-inspired  violence  as  opposed  to  thwarted 
plots,  which  are  often  rather  more  ambitious,  one  gains  a  deeper 
appreciation  of  what  is  most  likely  to  actually  take  place.  On  the  one 
hand,  the  frequency  of  attacks  has  certainly  increased.  On  the  other 
hand,  despite  recent  events,  lethality  has  not.  The  average  number 
of  people  killed  in  Western  countries  during  the  period  2001-2011 
(excluding  9/11)  was  10.1,  compared  to  six  from  2012-2016. 

The  fact  remains  that  despite  the  Islamic  State’s  best  efforts  so 
far,  the  most  likely  attack  scenario  still  involves  lone  actors  (a  sig¬ 
nificant  number  of  whom  appear  to  be  driven  as  much  by  mental 
illness  as  by  jihadist  ideology)  or  small  autonomous  groups,  using 
readily  available  weapons  to  attack  soft  targets  and  yet  still  gener¬ 
ally  resulting  in  failure.  Granted,  the  situation  is  extremely  dynamic 
and  the  tragic  events  in  Orlando  underscore  the  fact  that  terrorists 
do  sometimes  succeed  in  dramatic  fashion.  It  is  also  quite  possi¬ 
ble  that  others  will  be  inspired  by  Mateen  and  seek  to  replicate  his 
actions  elsewhere.  Yet  this  does  not  change  the  overall  balance  of 
probabilities.  The  majority  of  jihadist-inspired  violence  in  the  West 
remains  low-tech  and,  overall,  relatively  small-scale. 


Appendix:  List  of  attacks  included  in  the  analysis 

Cases  marked  with  an  asterisk  are  “borderline,”  meaning  questions  remain  about  the  motives  involved. 


2012 

March  (France):  Toulouse/Montauban  shootings  (7  dead) 
September  (France):  Grenade  attack  on  Jewish  supermarket,  Paris 
December  (Germany):  Attempted  bombing  of  Bonn  train  station 

2013 

February  (Denmark):  Attempted  murder  of  Lars  Hedegaard* 


April  (United  States):  Boston  marathon  bombing  and  murder  of 
police  officer  (4  dead) 

May  (France):  Stabbing  of  a  gendarme,  Rousillon,  Isere* 

May  (United  Kingdom):  Murder  of  a  British  soldier,  Woolwich, 
London  (1  dead) 

May  (France):  Stabbing  of  a  soldier,  Paris 
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2014 

April-June  (United  States):  Three  shootings  in  Washington  and 
New  Jersey  (4  dead) 

May  (Belgium):  Shooting  at  Jewish  Museum,  Brussels  (4  dead) 
September  (Australia):  Stabbing  of  two  police  officers,  Melbourne 
September  (United  States):  Beheading,  Moore,  Oklahoma  (1  dead)* 
October  (Canada):  Two  Canadian  soldiers  run  over,  Quebec  (1  dead) 
October  (Canada):  Shooting  at  Parliament  Hill,  Ottawa  (1  dead) 
October  (United  States):  Ax  attack  on  NYPD  officers,  New  York 
October  (Denmark):  Islamic-State-inspired  murder,  Kvissel  (l 
dead)* 

December  (Australia):  Lindt  cafe  siege,  Sydney  (2  dead)* 
December  (France):  Attempted  stabbing  of  police  officers,  Joue- 
les-Tours* 

December  (France):  Car  driven  into  pedestrians,  Dijon* 

2015 

January  (France):  Attempted  strangling  of  a  police  officer,  Metz* 
January  (France):  Charlie  Hebdo  attacks,  Paris  (12  dead) 

January  (France):  Shooting  plus  Jewish  supermarket  siege,  Paris 
(5  dead) 

February  (Denmark):  Copenhagen  shootings  (2  dead) 

May  (United  States):  Shooting  attack,  Garland,  Texas 
June  (France):  Beheading,  St.-Quentin-Fallavier  (1  dead) 

July  (United  States):  Chattanooga  shootings  (5  dead) 

August  (France):  Attempted  attack  on  Thalys  train  from  Amster¬ 
dam  to  Paris 

September  (Germany):  Stabbing  of  a  policewoman  by  a  convicted 
terrorist* 


September  (Denmark):  Stabbing  of  a  policeman,  Sandholm  asylum 
center* 

October  (Australia):  Murder  of  a  NSW  police  employee,  Sydney 
(1  dead) 

November  (United  States):  Stabbing  spree  at  University  of  Cali¬ 
fornia 

November  (France):  Stabbing  of  a  Jewish  teacher,  Marseille 
November  (France):  Paris  attacks  (130  dead) 

December  (United  States):  San  Bernardino  shooting  (14  dead) 
December  (United  Kingdom):  Leytonstone  Tube  stabbing,  London 

2016 

January  (France):  Car  driven  at  French  soldiers  guarding  a  mosque, 
Valance 

January  (France):  Attempted  knife  attack  at  Paris  police  station 
January  (United  States):  Attempted  murder  of  a  police  officer,  Phil¬ 
adelphia 

January  (France):  Stabbing  of  a  Jewish  teacher,  Marseille 
February  (Germany):  Stabbing  of  a  policeman,  Hannover 
March  (Canada):  Stabbing  at  a  Canadian  Forces  recruitment  center 
March  (Belgium):  Bombing  of  Brussels  airport  and  metro  (32  dead) 
April  (Australia):  Islamic  State-inspired  assault  within  prison, 
NSW 

April  (Germany):  Bombing  of  a  Sikh  temple,  Essen 

May  (Germany):  Stabbing  at  Grafing  train  station,  Munich  (1 

dead)* 

May  (France):  Stabbing  of  a  French  soldier,  Saint  Julien  du  Puy 
June  (United  States):  Nightclub  massacre,  Orlando  (49  dead) 
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